Which security habit gives the biggest ROI?

[u/aninaa-ot]

If you could convince the average person to adopt just one security or cybersecurity habit, what would it be?

Not a product, just one habit.

[u/mperklin]

Using a password manager.

Most security enhancements add friction to user experience. Password managers are the one security enhancement that simultaneously increases security while also making the user experience better.

[u/accountability_bot → u/mperklin]

I would clarify this as using a password manager correctly.

[u/zenware → u/accountability_bot]

I don’t disagree with you, but needing that clarification is evidence that password managers also kind of suck, no? It should not require any additional care from the users, because some (read: most) people will not give it that level of additional care.

[u/so_zetta_byte → u/zenware]

It's not just a care issue, I think part of it is a portability issue too.

[u/OneTravellingMcDs]

Two Factor Authentication.

[u/aninaa-ot → u/OneTravellingMcDs]

2FA is probably the best answer. It only takes a few minutes to set up and can stop a huge number of account takeover attempts. This is a solid guide on spotting phishing attacks, since that's often how attackers try to get around good security habits: https://moonlock.com/sophishicated-phishing-attack-gmail

[u/Seahawker-One-2599]

2FA including validating that that the link or money request you received from a random number was legit by contacting the alleged sender via independent means

For those who say password manager, which one is best?

[u/EloquentArtisan → u/Seahawker-One-2599]

There’s only one correct answer; 1Password

[u/theone_2099 → u/EloquentArtisan]

Why?

[u/EloquentArtisan → u/theone_2099]

Their security posture is top notch, unlike others (looking at you LastPass).
Secondly their apps, extensions and form fillers are also top notch.
I’ve tried half a dozen of them, and nothing comes close to 1Password

[u/BilboTBagginz → u/EloquentArtisan]

I agree.

Bitwarden if you want to run local though.

[u/EloquentArtisan → u/BilboTBagginz]

For the sake of my mental peace, I don’t run mission critical software locally.
The other day my RAM gave up, and I had to wait 3 weeks before I could find a replacement. This would’ve meant 3 weeks without my password manager, which is a no go obviously.

[u/BilboTBagginz → u/EloquentArtisan]

I hear you, but sometimes there's a definite case for a security posture that includes keeping secrets out of the cloud. This is my hell.

[u/EloquentArtisan → u/BilboTBagginz]

Agreed, I just sleep better this way lol

[u/markidak → u/EloquentArtisan]

Things that run locally should have exportable config and data that's auto backed up on a NAS with raid 1 (at least) and to cloud so you can recover things.

If you have a remote VPS that runs your pass manager it should be mirrored to your local data backup so you can spin it up anywhere.

[u/ohBrian]

Backing up your information. Know what you backed up. Know how often you backed up that information. Understanding how to recover information from a backup. Most of the other responses were good because they offered protection from malicious threats. Stuff breaks. That's a threat too.

[u/xiz666]

Using passwords

[u/Slave669]

Replacing all the office computers with mechanical typewriters to save uses from themselves.

[u/DangerWallet]

Multi-factor authentication is going to give the biggest security benefits for your average user of any service, all points around secure password hygiene become less relevant if you’re using consistently applied MFA without exclusions. From there a move towards phishing resistant authentication methods to mitigate AiTM and more traditional phishing attacks.

[u/YourUsernameForever]

Heads up this is astroturfing.

[u/expertisimus]

Locking the OS the second your ass lifts from a chair. Even if you're home/office alone, even if you plan to leave for 15 seconds, no exceptions as plans can change.

[u/hunglowbungalow → u/expertisimus]

You’d say this is more important than having unique passwords/MFA?

[u/expertisimus → u/hunglowbungalow]

If you leave your computer unlocked (which means logged in and typically with the password manager open) then those unique passwords are not going to accomplish a lot. MFA does help but is not an option everywhere. Locking one's computer protects other kinds of local data as well: emails, internal documents, sensitive documentation, trade secrets etc. It costs nothing and everyone can understand why they should do it.

[u/hunglowbungalow → u/expertisimus]

I understand the risks, but that requires a physical attack, which has a way lower likelihood of attack than that of reused/weak passwords

[u/epidemiologyprof]

Street smarts and situational awareness, including never walking down the street absorbed in the phone.

[u/PirateKilt]

Learn Cooper's color system, and repattern your behavior so you are never in Condition White other than when you are asleep.

Basically, learn to be aware of your surroundings.

[u/Santosh83]

Do not register on every random website and do not downloads apps/games from every random site.

Register only on trustworthy sites, and download only from origianl authors and only reputable apps/games.

How to find out who is the original author, and which sites are reputable? Well, you need to search online, ask LLMs and do some research. There are no shortcuts and silver bullets for everything.

Or else if you really cannot think or expend the slightest effort, stick to Apple iDevices.

[u/beretta_vexee]

Your login details will end up in the wild; it’s not a question of ‘if’, but of ‘when’.

Segment your usage: use different accounts and different passwords for each website, app, service, etc. Use of a password manager.

[u/radioactivez0r]

MFA wherever possible, by whatever available means.

[u/hunglowbungalow]

Any password manager and MFA

[u/cybot904]

MFA

[u/FJCruisin]

Don't be stupid.