🔐 Personal Digital Security & Privacy Hygiene

What you’ll learn

1. Who Are You Actually Defending Against?Replace the scare-list model of security with threat modelling, and set the three-doors frame the course runs on.Security advice usually arrives as an unranked list of everything that could go wrong, which is unusable — you cannot do everything, so you do nothing. Threat modelling asks four questions instead: what do you have, who wants it, how much trouble will they go to, and what happens if they get it. For nearly everyone the answer is opportunistic attackers working at scale, who are defeated by being slightly harder than average — a completely different problem from being individually targeted.
2. The Password Problem Is a Reuse ProblemSee that the real password failure is reuse rather than weakness, and that a manager is the only realistic fix.When a site is breached its passwords enter public corpora — Have I Been Pwned's November 2025 load alone carried some two billion email addresses and 1.3 billion passwords, 625 million of them never previously seen. Attackers then replay those pairs against every other site, which is why a strong password reused everywhere is worth exactly as much as the weakest site holding it. NIST's modern guidance drops composition rules and forced rotation in favour of length and checking against breach lists — and a password manager is what makes uniqueness possible at human scale.
3. The Second Factor, and Why SMS Is the Weak OneUnderstand what a second factor buys, rank the common methods honestly, and be clear that most 2FA is phishable.Two-factor authentication defeats credential stuffing outright, because a stolen password alone stops working — which is why it is the second-highest-value step after a password manager. But the methods are not equivalent: SMS codes can be redirected by SIM swapping and are the weakest common option, while app-generated codes are much better and yet still phishable, because any code you can read aloud is a code you can be tricked into reading to the wrong person. Any 2FA beats none.
4. Passkeys: The First Thing Phishing Can't BeatUnderstand why passkeys are structurally different from every other factor, and be honest about their rough edges.A passkey is a key pair: the site keeps the public half, your device keeps the private half and never reveals it, and login is a signature over a challenge. Two properties follow. There is no shared secret for a breach to leak, and the signature is bound to the real site's origin — so your device simply will not sign for a lookalike domain, which makes phishing fail by construction rather than by your vigilance. The rough edges are real: uneven support, and account recovery still runs on older methods.
5. Phishing Attacks You, Not Your ComputerReframe phishing as an attack on human decision-making, and replace spot-the-fake advice with a habit that works when you're fooled.Phishing bypasses every technical control by persuading the authorised user to act, which is why no update patches it and why the human element featured in 60% of breaches in Verizon's 2025 report. Spotting fakes by their tells is unreliable, because the tells have largely gone and the messages are timed for when your judgement is worst. The durable defence is structural rather than perceptual: never act on the channel that contacted you — go to the service yourself, by a route you already had.
6. The Boring Two: Updates and BackupsMake the case for the two least glamorous habits, and understand why one of them is the only defence that works after you have already lost.Most exploited flaws are not secret: they are published when the fix ships, and attackers read the fix to build the attack, so the window between a patch's release and your installing it is when you are most at risk. Turning on automatic updates converts a decision you would postpone into a default. Backups are categorically different from everything else in the course — they are the only measure that helps after prevention has already failed, which is why ransomware and a dead drive have the same answer, and why an untested backup is a rumour.
7. What Your Devices and Apps Actually ShareSeparate privacy from security honestly, and target the small number of controls that genuinely change what leaves your device.Privacy is a different problem from security: the data is being collected legally, by companies you agreed to, and the risk is aggregation over time rather than a break-in. The controls that actually matter are permissions — especially location, which is the most revealing signal a phone holds — the advertising identifier, and the reality that data brokers combine feeds from many apps. Realism matters: most measures reduce rather than eliminate collection, and pretending otherwise is how people give up entirely.
8. Recovery Is the Back DoorSee that an account is only as strong as the process that restores it, and leave with a ranked plan rather than a list.Every strong authentication measure has a bypass built in for the day you lose your device, and that bypass is usually your email — which makes email the keystone account rather than one among many. Security questions are secrets whose answers are often public or discoverable, and recovery codes are the honest alternative. The course closes by ranking everything it taught: the top three actions close all three doors, and doing them beats a longer list you never start.

Questions this course answers

Grounded in trusted sources

• Verizon, '2025 Data Breach Investigations Report' (human element in 60% of breaches; stolen credentials the top initial vector at 22%; phishing 16%; 88% of basic web app attacks used stolen credentials) — https://www.verizon.com/business/resources/reports/dbir/
• Troy Hunt, '2 Billion Email Addresses Were Exposed, and We Indexed Them All in Have I Been Pwned' (November 2025: ~2 billion addresses, 1.3 billion passwords, 625 million previously unseen) — https://www.troyhunt.com/2-billion-email-addresses-were-exposed-and-we-indexed-them-all-in-have-i-been-pwned/
• Have I Been Pwned — Pwned Passwords — https://haveibeenpwned.com/Passwords
• NIST Special Publication 800-63B, Digital Identity Guidelines — Authentication (length over composition rules; blocklists of breached passwords; no scheduled expiry) — https://pages.nist.gov/800-63-4/sp800-63b/passwords/
• FIDO Alliance — Passkeys — https://fidoalliance.org/passkeys/
• W3C, 'Web Authentication: An API for accessing Public Key Credentials' (WebAuthn) — https://www.w3.org/TR/webauthn-2/
• US Federal Communications Commission, rules to protect consumers from SIM swap and port-out fraud (2023) — https://www.fcc.gov/document/fcc-adopts-rules-protect-consumers-cell-phone-account-scams
• US Cybersecurity and Infrastructure Security Agency, 'Known Exploited Vulnerabilities Catalog' — https://www.cisa.gov/known-exploited-vulnerabilities-catalog

Every Wunder lesson is built from real, reputable sources — never invented.

Related Science courses