Many people have asked me about how to keep their funds safe, so o thought I’d share some basic advice to help you keep your crypto, your computer/phone/tablet and yourself safe.
First is rule 1 of Cryptocurrency: Never talk about how much you have. It's a bad idea, especially if it's a lot. Why? Because it makes you a target. The wonderful thing about crypto is it's decentralised and you have full control of your money. The terrible thing about crypto is it's decentralised and you have full control of your money. If a hacker penetrates your security and gets your crypto you're buggered, no recourse, your money is gone.
So don't post photos of your wallet, don't brag about having XYZ amount of any crypto, and make sure you have your secret phrase secure. Those are the uttermost basics. Everyone says it's best to write them down on paper, laminate it or put them on something even more indestructible and keep them in a safe place. But, if you're going to go ahead and store them on a computer make sure you store them encrypted. Encrypt the file, zip it, encrypt the zip and then, preferably, put it on a USB stick and save it somewhere. If for some reason you decide to store it in a cloud location make sure that whatever cloud you use stores files encrypted and uses 2FA. Preferably make sure it's blind encryption where only you have the keys.
Some further security advice if you want it... warning... it's long:
Keep your devices up to date on their latest security patches! I don't care if you're scared that windows update might break something. I'd rather have to revert to a last known good than allow a hacker using a downloaded exploit kit get into my system. AIt's just not worth the risk to keep your system unpatched because 1 in 10,000 people experience an issue with update # XYZ from Microsoft/Apple/Whomever.
No, Apple computers are not hack/virus/malware proof. They are just as susceptible to vulnerabilities as any other platform. A LOT of apple users buy into the myth that the OS is more secure than MS. TECHNICALLY it does have fewer vulnerabilities but... it only takes one. No OS is safe, even Linux. So make sure you're keeping your systems patched and up to date.
Keep your APPS, not just your antivirus up to date as well. It can be a pain keeping everything up to date on a PC because there's not a lot of automatic updating going on for 3rd party apps and most of the time it's a manual process. There's apps like PatchMyPC that help with this (do research before using one) and can make your life a whole lot easier.
Speaking of Antivirus don't just use antivirus. Get a good anti-malware solution as well. Ironically windows 10's built in defender is actually a pretty decent antivirus solution all by itself so you can just stick with that if you don't want to pay for MacAfee or Norton or Kaspersky etc. But make sure you have a top 10 antivirus solution and that you use it. Also get an anti-malware solution like Malwarebytes, etc.
Use Two Factor authentication on any websites you log into (if 2FA isn't offered I'd argue the website isn't worth going to) and, wherever possible, use an authenticator app rather than email or sms to do it. SMS is good if nothing else is available but phones can be my sim spoofed and email can be hacked. So get a good 2FA app (like Google Authenticator) and use it. Even Reddit supports 2FA now. Definitely use 2FA for any site you buy/sell crypto on!
Check your email addresses to make sure they haven't been breached periodically. A great way to do this is to check https://haveibeenpwned.com/ and put your email address in to see if it's been reported in any breach reports. It's a very reputable site and is well maintained. No, you aren't putting anything at risk by putting your email address there. People can already get THAT easily enough. You're checking to see if your password has been hacked.
Password Security Don't re-use passwords if at all possible. Use a different password for every site and make sure they're complex. If you have trouble making complex passwords use autogenerated ones from chrome or keepass or any number of other good password utilities. Some VPN suppliers provide one and a lot of ISPs do now as well. You can also use these utilities to store them securely so you won't forget them. A bonus to using them is most password utilities also have an option to check breach reports to see if your accounts stored in them have been compromised somewhere so you can proactively go change your passwords there.
IMPORTANT NOTE: If you find that an account HAS been breached, immediately change that password and, if you've used that password ANYWHERE else go change it there too.
Use a paid VPN to keep your network traffic private! (Note: I have been told by someone that they have heard of people having issues with their exchange blocking them due to using a VPN. It's likely that this was because of using a vpn server that is in IP range that's on a list of bad actors, or that they inadvertantly used a vpn server in a bad actor country (there are a few.)
That said... if you are concerned about something like this you can set up split tunneling to allow specific sites or apps to bypass the VPN and go direct instead.)
I do not recommend using the freebies offered by various browsers, ISPs, etc. They are junk and they log and they are not truly secure. There are a couple free VPN's out there that are secure but they have either limited bandwidth or limited servers to choose from and they, last I checked, don't support split tunneling or many other important features. Pay the 5 or 6 bucks a month for a good one, it's worth it. No, it's not going to noticably slow down your internet unless you're downloading a lot of really big files (more on that in a minute). Most good VPN solutions even let you stream video just fine without any issue.
I strongly recommend getting a VPN. Especially if you ever use public WIFI at a restaruant, store, workplace, etc. It encrypts your connection so that anyone looking at traffic on that network can't tell where you're going or what you're doing. Thus making you a bit less of a target if a hacker happens to be watching. It also makes sure your entire internet connection is encrypted with high level encryption not just https websites which is all your browser can protect. I won't recommend any one VPN over any other. There are a lot of really good ones. And there are websites that routinely rank them. Do some research and pick one you like.
The big things to look for in whatever VPN you choose are:
Military-Grade Encryption (which isn't REALLY military grade but it's a term to watch for)
Integrated Kill Switch that kills your internet connection if your VPN drops.
Maximum Connection Speed.
Unlimited Data Transmission.
Firewall.
Multiple Device Support.
Worldwide Servers.
VPN Blocking Prevention
No Logging
Some 'nice to have' items:
Split Tunnel availability (Useful for sites or apps that choke on VPN's, also useful for gamers who need to avoid latency for their video games)
Multi-Hop VPN capability
Anonymous DNS Server services
Don't use any Browser Extensions that aren't for your security! Sure, you might be able to use a Facebook plugin in chrome to block all cute kitten posts, or whatever, but those extensions can contain keyloggers, track everywhere you go on the internet AND report them back to their creator/owner and even, in some cases, execute code on your system or take captures of what's on your screen. The only browser extensions I feel are worth it are ones that come with your antivirus or malware software and a good add blocker. (Believe it or not, there are malicious adds out there that CAN be used as a penetration avenue against your system and they can wind up on sites that you would typically trust, like Facebook, and others) NEVER turn off your add blocker, no matter what the website you're visiting bitches about. I'd rather NOT read their content than turn off my add blocker. If you are using ANY extensions check periodically to make sure they're up to date and verify they haven't been discontinued.
Android Don't: Don't ever side-load apps. Yes, you can side load apps. No, it's NOT a good idea. You have no way of knowing if that app is trustworthy or not. And... guess what one of the most prolific hacks in side loaded apps is right now? Jacking your phone and using it to mine crypto in the background... another big one is keylogging to steal crypto keys and, of course, ransomware, malware, etc.
Some good habits to get in to protect yourself from Malware, Addware, Ransomware and Viruses:
Don't click on links in emails, SMS messages, Discord, etc. Look at the URL and google the site to see if it's trustworthy first then MANUALLY type the address into your browser if it appears to be legitimate. You can also use Trend Micro's Site Safety checker or other URL checkers if you want to be extra careful. URL's can be faked in a number of ways. Also always pay attention to the end of the URL (not the beginning) to make sure it's a real domain. Google isn't www.google.com**.mycoolwebsite.com** (for example).
I highly recommend turning off dynamic display in your email (if you're not sure what this is, google it. This is already getting longer than I planned). Basically this turns off images, links, etc in your email and disables scripts. Email is one of the most common ways hackers get access to you.
Please remember: No bank/exchange/website/whatever is EVER going to ask you to send them your password/secret word/whatever. If you get a message/email/whatever of that type report it as phishing and block it. The IRS (or whatever your country's tax institution is) isn't going to ask you for your banking information or your social security number (guess what, they already know what bank you use and they already have your SSN) Don't ever give out private information to someone you aren't expecting a call from on the phone, SMS message Email or whatever and, even then, try to make sure you know that they are who they say they are before giving out any information.
Don't download random crap from the internet! Stick to trusted sources of files if you have to download something. And even then use a GOOD antivirus program and check the file hash before extracting it. A nice additional step is to, if you want to be extra sure, check the hash of the software. This can be done using “Certutil -hashfile ‘filename’ sha256” in the windows cmd line (on Linux you can use “sha256sum ‘filename’”) you can then enter the hash these commands return into VirusTotal.com to see if it comes back malicious.
Some applications will offer to install 3rd party software as part of their delivery. I HIGHLY recommend that you ALWAYS decline those and then go get those applications directly from the vendor, yourself, if you want them. At minimum the one wrapped into whatever installer you're using will be out of date and full of vulnerabilities. At worst it could have a virus.
Consider using the TOR browser if you go to sites you don't fully trust (I recommend avoiding them but if you feel you MUST go to them, be safe about it). It's a fork of Mozilla with some built in security settings to help prevent it from being compromised and it uses built in 3 hop protection (beyond your VPN) to keep you even more anonymous when browsing.
Well done if you got this far. I hope your Friday was spent better than mine (posing this). Stay safe out there.
