Tricking people into sharing personal details and logins by pretending to be someone else — known as phishing — is surprisingly effective. Some of the smartest people I know have been taken in by it and it only takes a moment’s lapse in concentration or uncertainty to fall for it. The maths is simple: it barely costs anything to send an email to 100,000s of people and it only needs a few people to get caught in the net for it to pay off.

Also, look out for targeted spear-phishing attacks where scammers may seem to know specific details about yourself to make the attack more credible. Or what’s known as whaling — the targeting of high-profile figures such has heads of companies or celebrities with elaborately planned and sometimes very convincing schemes.

You can also check if you’ve been caught in a data breach at: Have I been Pwned.

Types of phishing

Two factor authentication is the neat technique of adding extra security by requiring two different types of verification. So, rather than ask you to provide two passwords — both things you could remember or find written down — if you are asked to provide a password and a code you could only have if you had a particular device, security is greatly enhanced.

The usual factors involved include asking for two from:

Hence the convenience of photo ID where you have to provide the ID and also look like the photo. Or provide a ticket and a code, or a chip and pin…

Also see: choose passwords that make you happy, and 8 character passwords.

2 factor authentication

Update: for times when you really need to remember a password I still like this technique, for all other times — which is to say, ideally every time — I suggest using a password manager. Use a password manager to generate unique passwords for every service so long and complex that you couldn't possibly be bothered to type it and that will force you to always use the manager instead.

However, for the few passwords that you can't avoid typing they might as well remind you of something good. I have found this makes me happier.

Choose passwords that make you happy

Which, remarkably, still does not mean they are secure.

Sketchplanations tagged with security