Learn · Security
Security basics
Passkeys
A passkey replaces a password with a key pair. The private key stays on your device and never reaches the website; the site stores only the public key. Two consequences follow, and both matter: a breach of that site cannot leak your password, and a phishing page cannot use a passkey because it is bound to the real site's origin.
Where a site offers passkeys, they are the strongest option available to most people.
Multi-factor authentication
Not all second factors are equal:
| Method | Phishing resistant | Notes |
|---|---|---|
| Security key / passkey | Yes | Strongest widely available option |
| Authenticator app code | No | Good; a convincing fake page can still capture the code |
| SMS code | No | Vulnerable to SIM swapping — still far better than nothing |
Password managers
The real benefit is not convenience, it is that every site gets a different password, so one breach stays contained. A manager also declines to autofill on a lookalike domain, which quietly defeats a lot of phishing.
Phishing and lookalike domains
Check the domain immediately left of the final dot. In
secure-paypal.example.com the real domain is
example.com, not PayPal. Watch for character substitutions —
rn for m, a Cyrillic а for a Latin
a.
Urgency is the tell. Legitimate organisations do not need you to act within ten minutes.
HTTPS, precisely
The padlock means the connection is encrypted and the certificate matches the domain. It does not mean the site is trustworthy — phishing sites get certificates too, free and in minutes. HTTPS protects the channel, not the intent of whoever is at the other end.
What a VPN does not do
A VPN moves your traffic's exit point. It hides your IP from the sites you visit and your browsing from your local network. It does not make you anonymous: it cannot stop cookies, fingerprinting, or a site recognising you when you log in. You are also transferring trust from your ISP to the VPN provider — which is a choice, not an elimination of risk.
Updates
Unglamorous and the highest-value thing on this page. Most real-world compromises exploit something already patched. Turn on automatic updates for your OS and browser and stop thinking about it.
Last reviewed: 2026-09-12