security basics
19 articles with this tag
How to clear browsing history, cookies and saved passwords (Chrome, Safari, Edge, Firefox on computer and phone): what to delete after a leak, and what to keep first
A guide to deleting browsing history, cookies (site data), cache, saved passwords and autofill in Chrome (Windows, Mac, Android, iPhone), Safari (Mac, iPhone, iPad), Edge and Firefox, using the labels in each vendor's official help. Deleting browsing history does not take back anything already copied and is not a defence against a threat. What reduces future harm is dealing with sign-in state (cookies) and saved passwords: change passwords and sign out of all sessions from a safe device. If you will go to the police, record the threatening email and any suspicious extensions before deleting. If sync is on, deletion also removes the data from your other devices on the same account. In the October 2026 Onamae.com Desktop Cloud case, GMO Internet's sixth notice asks customers to keep browser sync off until their device check is done.
What is GDPR: the EU's data-protection rules and breach-notification duty
GDPR (General Data Protection Regulation) is the EU's comprehensive rulebook for protecting the personal data of people in the EU — and it can reach businesses outside the EU that serve EU users. It requires a lawful basis (e.g. consent), clear purpose, data minimization, data-subject rights (access/erasure), and breach notification to the authority (generally within 72 hours), with heavy fines for serious violations. The technical gist: collect and hold only the personal data you need, protect it, and be able to detect and report a breach quickly.
What is the OWASP Top 10: the standard list of the 10 biggest web-app risks
The OWASP Top 10 is a list the non-profit OWASP publishes every few years of the 'most critical web-app risks.' It's a common language for developers and operators. The current 2025 edition (announced November 2025) is still led by Broken Access Control; Security Misconfiguration rose to second, and two new categories were added: Software Supply Chain Failures and Mishandling of Exceptional Conditions. SSRF was merged into Broken Access Control. These are risk CATEGORIES, not individual exploits, so use them as a lens to audit your own app.
What is public-key cryptography: encrypting and signing with a key pair
Public-key crypto uses a 'public key' (safe to hand out) and a 'private key' (held only by the owner). Anything encrypted with the public key can only be decrypted by the matching private key, and a signature made with the private key can be verified with the public key. That asymmetry underpins TLS (HTTPS) key exchange, digital signatures, and passkeys. Defenses: don't roll your own crypto (use standard protocols and proven libraries), protect and be able to revoke the private key, and keep key length and algorithms current.
Authentication vs authorization: a login alone doesn't protect other users' data
Authentication = verifying who someone is; authorization = deciding what they may do. They're different, and adding a login is not authorization. Without owner (user_id) scoping on data, 'logged in = sees all data' — the top-ranked OWASP Broken Access Control. Add a scaffold with registration left open and a stranger can sign up and get in. Defenses: scope every query to the owner, close unneeded registration, defense-in-depth, audit/access logs before an incident, detect new sign-ups.
How do people store passwords? What the data shows — and the safe way
Representative surveys show ~54% rely on memory, ~33% write passwords on paper, and only ~36% use a dedicated password manager — with ~25% reusing passwords. Meanwhile Verizon's DBIR found credential compromise involved in ~38% of breaches and that ~74% of passwords in breach data were reused. In short: the most popular storage habits are the easiest for attackers to exploit. The safe basics are a manager (unique password per site) plus passkeys/MFA on your key accounts.
Security for the AI era: the basics to lock down now (priority checklist)
AI mostly amplifies attacks on EXISTING weaknesses (unpatched CVEs, reused passwords, exposed secrets) rather than inventing new ones — found automatically, fast, at scale. So the best preparation is locking down the basics in the right order: CVE patching + dependency monitoring, stop password reuse + MFA, remove exposed secrets, least privilege, shrink the public surface, logs/IOCs, backups.
AI-era security measures that work and ones that don't: why small sites get targeted too
Four AI-era misconceptions corrected: (1) too small to be targeted → automated attacks don't need a human to pick a target; (2) needs a special new control → the basics still work best; (3) a product makes you safe → prevention design before detection; (4) AI code is fast so it's safe → it can ship with vulnerabilities, so review before publishing. What works is the boring basics in the right order.
Backup essentials: the 3-2-1 rule and a recovery plan that survives ransomware
'I have a backup' isn't enough — only a backup you've verified you can restore is useful. The basics: the 3-2-1 rule (three copies, two media types, one offsite). For ransomware you also need at least one 'offline or immutable' copy — an always-connected backup gets encrypted along with the original. Cloud sync is not a backup (it replicates deletions and encryption too). Versioning and a periodic restore test complete the practice.
Choosing MFA the right way: what 'phishing-resistant' means, and why SMS is weak
MFA uses different factor categories. Manually entered codes can be relayed through phishing; SMS also depends on control of the phone number. Prefer phishing-resistant methods such as passkeys or FIDO2 security keys for important accounts, check user-verification requirements, and protect recovery methods too.
Still on Windows 10? The security risks of running it after end of support
Regular support for Windows 10 Home/Pro-family 22H2 ended on October 14, 2025. Official guidance checked on October 16, 2026 lists consumer ESU through October 12, 2027, with automatic continuation for existing enrollees. Check enrollment and updates on the device, review regional conditions, and prioritize migration to an OS that receives updates. LTSC/IoT and commercial ESU are separate.
Securing a laptop you carry around — protecting against theft, loss, and shoulder-surfing
Carrying a laptop assumes you'll lose it or it'll be stolen. The main defense is setting it up so a loss doesn't leak the contents: disk encryption (BitLocker/FileVault), a strong login with a short auto-lock, and remote wipe/locate. With HTTPS everywhere, public-Wi-Fi sniffing is lower priority; the real threats are rogue APs, shoulder-surfing, and walking away. Don't over-trust a VPN — harden the device first.
Are password managers safe? How they work, cloud vs local, and how to choose
A password manager helps you use a strong, unique password for each service. Zero-knowledge encryption is designed to protect contents even if encrypted data leaks from the provider, but safety also depends on master password strength, encryption settings, and device security. Use MFA to prevent unauthorized logins, and choose cloud or local by use.
The dangers of public Wi-Fi: fake access points and certificate warnings matter more than sniffing
Public-Wi-Fi 'sniffing' is mostly mitigated by HTTPS and is lower priority now. The real risks are (1) connecting to an evil-twin fake AP yourself, (2) ignoring certificate warnings, and (3) exposing your device on the shared network. The most effective measures are simple: use your phone's tethering, trust HTTPS and cert warnings, and don't auto-join unknown SSIDs. A VPN is the next layer.
The security baseline for indie devs and small operators: standard controls in priority order
The baseline isn't 'all equally important.' This site's priority order: 1) admin accounts, domain and email (MFA), 2) secrets and code, 3) the app itself, 4) patch, detect, recover. With finite time, fill it top-down. Most serious breaches come not from novel attacks but from a gap in these basic controls.
An organization's security minimum: six priorities worked back from Japan's 2026 breaches
An organization's 'minimum' should be set by where real incidents broke through, not by a product list. Line up Japan's 2026 incidents and the entry points differ — a VPN appliance, third-party software, a query feature, undisclosed — yet the causes that widened the damage come down to six: (1) close internet-facing devices on a deadline, (2) narrow maintenance, contractor and leaver accounts, (3) watch volume and time, (4) keep logs long enough to look back, (5) don't keep data you no longer need, (6) re-prioritise by KEV. This site's view: the minimum is deciding who notices, on which number, and when.
Security inventory: 7 checks people running several servers overlook
For solo/small operators, incidents come less from missing controls than from untracked state. The boundary is the PC holding your keys. Prioritize 2FA by which account can recover the others (email first), list which SSH key opens which server and delete duplicates, unused keys and leftover registrations, remove plaintext passwords from the cloud, remediate reversibly one at a time, and keep secrets out of the ledger. Inventory before adding tools.
Smartphone security basics: protecting the one device that holds your passwords, payments, and ID
A phone concentrates 2FA, email, banking, and ID into one device, so losing it affects many services (a single point of failure). The most effective protection isn't a security app: (1) a strong lock + short auto-lock (the passcode is the encryption key); (2) automatic OS/app updates; (3) official store + permission review; (4) set up remote lock/wipe in advance; (5) keep a backup of your 2FA. iOS/Android already encrypt and sandbox by default.
Is storing your passwords in Google Drive safe? How to keep them properly
Keeping passwords in a plaintext Google Doc/Sheet is dangerous: one Google account becomes the single point of failure for every password — account takeover, a rogue connected app, or phishing leaks them all at once. The safest option is a dedicated password manager (contents stay encrypted even when synced). If you must use Drive, store only an encrypted vault file and put phishing-resistant MFA on the account.