How many sites do you log into? Bank, email, shopping, work tools, social networks — each one wants a password, and serious sites add rules about length or character types. You already know not to use the same password everywhere. Recycling variants (david1, david2, david3) is not much better: one leak still maps to the rest. For what weak choices look like in the wild, see Passwords used by the Conficker worm. ...
It’s not possible to emphasise enough the importance of using sensible passwords on your network. Not just on the areas of your network that you don’t want your users to traipse through, but also on the default network shares that are present on installations of commonly used operating systems. The Windows versions Conficker targeted — NT, 2000, XP, and 2003 — are all end of life and no longer receive security updates. The lesson still applies to any machine with open shares today. ...
Treat passwords with as much care as the information they protect. For how to make them strong — and why a manager should generate them — see Passwords. These tips are about keeping secrets secret day to day. 1. Never provide your password over e-mail Phishing messages pretend to be a bank, a shop, or a social network and ask you to “confirm” your login. Legitimate services do not need your password by email. Learn how to spot phishing. ...
Communicating by using an instant messaging (IM) program has some of the same security and privacy risks as e-mail, but there are a few dangers that are unique to IM. The original 2009 version of this guide was written for desktop IM clients like AIM and MSN Messenger. The same principles apply to modern apps — WhatsApp, Telegram, Signal, Discord, Slack, and iMessage. 1. Never open files or links from strangers Never open pictures, download files, or click links in messages from people you don’t know. If they come from someone you do know, confirm with the sender that the message (and its attachments) is trustworthy. If it’s not, close the conversation. ...
Social networking Web sites like Facebook, Instagram, X (Twitter), LinkedIn, TikTok, and Threads are services people can use to connect with others to share information like photos, videos, and personal messages. As the popularity of these social sites grows, so do the risks of using them. Hackers, spammers, virus writers, identity thieves, and other criminals follow the traffic. Read these tips to help protect yourself when you use social networks. ...
Strong passwords still matter, but the way we handle them has changed since this post first ran in 2009. The default today is simple: let a password manager create a unique random password for every site, turn on two-factor authentication (2FA) wherever it is offered, and use a passkey when a service supports one. What actually makes a password strong Attackers guess and crack passwords with dictionaries, leaked lists, and raw computing power. Strength comes from: ...
Antivirus software (sometimes spelled anti-virus) tries to identify, neutralize, or eliminate malicious software. Early tools targeted computer viruses; by the late 2000s products already aimed at worms, phishing-related payloads, rootkits, Trojans, and other malware. This page is a primer from that era — useful background when reading the scareware dossiers on this blog (WiniGuard, SecurityTool, and related clones). Pair AV with careful browsing (site advisor, hosts file) rather than treating any one product as enough. ...
You can block a lot of ads and tracking by editing the hosts file on Windows and other operating systems. It is a local override that runs before your ISP’s DNS — useful against known bad domains as well as noisy ad servers. Once you rely on a custom hosts file, also read Protect Hosts File so malware cannot quietly rewrite it. Pair with a real antivirus and, where helpful, a site advisor-style reputation tool. ...
Online fraud is annoying, costly, and risky for both your accounts and your computer. You can cut a lot of that risk by learning to recognize scams and keeping a few habits consistent. Identity theft predates the web, but going online made it cheaper for criminals to reach large numbers of people. Attackers who want your accounts use phishing, hoaxes, and related tricks to obtain personal information — name, government ID numbers, account names, passwords, and more. ...
Malware sometimes rewrites the hosts file to redirect you to malicious sites or to cut you off from update and security vendors. Locking the hosts file makes unauthorized edits harder. This note was written when Avira Premium Security Suite could lock the hosts file from its firewall settings. Product UIs change; the idea remains: immunize known malware domains first, then prevent silent rewrites. Before you lock Review how the hosts file works. Immunize by blocking known malware domains (for example with a hosts manager such as HostsMan). Then lock the file. Unlock periodically if you want to refresh blocked domains (weekly or monthly). Locking with Avira (historical steps) Assuming you have Avira Premium Security Suite: ...
A website reputation tool (often called a site advisor) warns whether a site looks safe, questionable, or risky — commonly shown as green / yellow / red next to search results. These programs usually install as a browser add-on and surface ratings while you use engines such as Google or Yahoo. They typically flag sites associated with phishing or scams, viruses or spyware, spam, browser exploits, and similar abuse. How ratings work Reputation metrics are usually collected from other users who have interacted with the site. Each user indicates whether they were satisfied or not. In the simplest model, reputation is an aggregate of those past ratings. ...
If you suspect that you’ve responded to a phishing scam with personal or financial information, take these steps to minimize any damage. Step 1: Report the incident Contact the following authorities: Your credit card company, if you have given your credit card information. The sooner an organization knows your account may have been compromised, the easier it will be for them to help protect you. The company that you believe was forged. Remember to contact the organization directly, not through the e-mail message you received. In the United States, report identity theft at IdentityTheft.gov and file a fraud report at ReportFraud.ftc.gov. You can also report the phishing scam to the Anti-Phishing Working Group by forwarding the phishing e-mail message as an attachment to [email protected]. ...