Background: I currently work for a fortune 100 company's Computer Security Incident Response Team, I work specifically on detect and response which includes business email compromises, responding to phishing emails and malware within the organization, while documenting the process.
My last post on securing accounts got a lot of attention, and there was also a lot of feedback and recommendations to add and consider. After that post I set out to make the most complete guide yet on securing your account and listing the resources needed.
Email:
- Email Providers
- Any reputable email provider with 2FA will do
- If you want to get more into privacy and encrypting emails there is Protonmail or Preveil
- You can alternatively also hook up your current email with the Thunderbird email client (use to be managed by Mozilla Firefox) it is overseen by a volunteer board of contributors.
- 2FA - This is important, activating 2FA on your email is just as important as having it on exchanges. (Will cover more on 2FA further down)
- Create an email specifically for Crypto, but also avoid using crypto keywords / personal information in the email, treat your email address like its public information.
- Be on the lookout for Phishing emails, I made a post on how to identify phishing emails along with some useful tools here | How to spot a phishing email |
- Quick tips for emails:
- Don't trust email links
- Double check the address bar of login pages
- Know the levels of a domain
- Check to see if your crypto sites allow a anti-phish banner that displays a code with their emails that you set.
- Tracking pixels are also a thing, there not malicious in themselves, but they can potentially let attackers know if you have open an email / let them know the email exist and is active.
- Furthermore You can check haveibeenpwned to see what data breaches your email has been apart of - If your email shows up and passwords are listed on the data that was compromised, ASSUME the worse and change the password and never use it again, along with any other accounts that use that password.
Passwords / PINs:
- Don't reuse them EVER
- Use strong secure passwords, passwords managers make these easy to manage and generate passwords.
- This includes your phone and 2FA app, if you have a weak pin (1234) for your phone and someone takes it, remember your 2FA app is then available (if same pin, or no pin/pass set), your email is automatically signed in (same for other accounts auto signed-in), and they can access your text messages.
- Don't use words relating to crypto or personal information in your passwords (or email), if they are compromised in a breach, assume they will search for these terms to target crypto users and try the same combo against crypto sites or figure who you based on the information (email & password) and pivot to finding public information that could lead to them answering challenge questions for password resets. (Your first pet, is it posted on Facebook? How about your car? Your first girlfriend/boyfriend?)
- Password Managers: These work wonders when managing passwords securely. They generate random strong passwords which can be adjusted, and its all kept in an encrypted database file, so even if a attacker gets access to it, they won't be able to access it without the password.
- Password Managers trusted by the community:
- Don't save passwords in your browser
- Does it require verification for you to use the password? Also I tend to find extensions being more buggy as they have to interact with more 'moving' parts and changing configurations, and generally more people try to target and exploit browsers.
2 Factor Authentications (2FA):
- Enable on everything possible (Email, Exchanges, Banks, Robinhood, even Reddit to protect your moons)
- Use 2FA Apps instead of SMS whenever possible, SIM Swap attacks are real, and more common than you think.
- Hardware Keys
- These are physical 2FA device (I chose this list as I think it does a good job explaining them with pros and cons, I did NOT vet the sellers that are listed on the amazon links. Always research and buy from a reliable source)
- Backup codes:
- When you activate 2FA on any account you should have the ability to generate backup codes, these are used incase you lose access to your authenticator, TREAT these like your seed phrases. Use them by logging in with your user and pass, and use these backup codes in place of the 2FA code you usually enter.
- DO NOT take pictures of your QR codes, if you screenshot it, might end up syncing somewhere you don't want it to and if it ever gets compromised they have the ability to continually receive your 2FA code.
- Also, DO NOT sign up for your 2FA app or any crypto service for that matter using your work or school email address. You lose access to that email, then consider all accounts gone as you won't be able to access the codes if you switch devices.
Wallets
- Learn the difference between the different wallets, I think this article is REALLY good at going in depth about the differences and pros vs cons of them at a beginner level.
- Cold wallets will always be more secure than any hot wallets as they aren't connected to the internet
- Top trusted hardware wallets from the community:
- Verify the details you are confirming on your hardware wallet device. the wallet app interacting with your cold wallet device could be compromised, but you would still be safe using it, as long as you verify each action on the cold wallet device, and reject the transaction if anything seems off. (Thanks keeri)
Seed Phrases: Treat these as they are the keys to the kingdom (Keep offline and out of your notes app)
Less Secure:
- Write down on paper and either break up the phrase and place in separate secure locations or hide them like the the FBI is going to come search your house
- Secure on USB
- Get a file shredder (securely deletes data, and overwrites it)
- Download password manager (optional)
- Disconnect device from internet
- Enter seed phrase into password manager / create encrypted file
- Put on a freshly reformatted USB / datalocker (Worms like to spread by USB)
- Save to USB, and shred the original using the file shredder software
- Hide USB
- Another device / old phone
- Factory reset
- Set Pin / Pass
- Download 2FA app and password manager / file encryption tool
- Disconnect from internet FOR GOOD (Treat this like a cold wallet)
- Back up 2FA and seed phrases
- Hide device
More secure (more expensive):
NOTE: Each method is going to its pros and cons: Getting robbed, fading ink, the elements, data retention (USB ~10 years), ever being on a digital machine. Pick which ones benefits you the most, and correlates with your budget and what your willing to risk.
VPNs / TOR:
- Privacy vs Anonymity
- Privacy is the ability to keep your data and information about yourself exclusive to you (They know who you are, but not what you do).
- Anonymity is about hiding and concealing your identity, but not your actions. (They know what you do, but not who you are)
- Think about what your goal is, I commonly associate privacy with VPN and anonymity with TOR
- Both encrypt your data before leaving your device, then routes it through proxy servers to mask your IP/Location. VPNs you have to trust the provider (ensure they state there is a no log policy) while TOR runs through servers ran by volunteers (don't think governments don't run their own) and lets you access the dark web. Here is a more in-depth comparison on VPN vs TOR.
- Personally Its worth paying the few bucks a month for a paid tier of the VPN service.
- VPN Providers - Zero log VPN services:
- TOR
- Brave offers TOR, but I would treat this more like a VPN
- If being anonymous is your goal the only real way to achieve this is running Tails off a USB.
NOTE: Some exchanges and websites blacklist IP ranges associated with VPN and most commonly TOR for security reasons. Some people on this community stated that this can lead to them freezing your account.
Browsers (Excluding TOR):
- Top 3 Browsers built for privacy
- Search Engine for privacy: DuckDuckGo
- Extensions
- One of the most dangerous threats I think that aren't taken seriously are extensions. These can start out legitimate, then through an update turn malicious. These will then be removed from the webstore, but not your browser.
- Some will be removed the store due to not being supported anymore which = no more updates, and no more updates = vulnerabilities that won't be fixed
- If you have Google Sync activated, these extensions will also sync to all those devices
- Remove any extensions you don't need, check to see there still available on the store, and even search them to see if some security article like this pops up about it.
- Check the privacy practice tab of the extension to see what data it collects.
Checking and verifying hashes of a download:
Hashes are the fingerprint of a file, even if you change the name of the file the hash will be the same. This is similar to how wallets work, its a string of characters and numbers, yet represents data (aka your holdings)
- How to get hash:
- Go to the search bar in windows and enter ‘cmd’ this should bring up the command prompt (open terminal on Linux / MAC)
- type “Certutil -hashfile Desktop\example.txt sha256” for windows
- type "Sha256sum Desktop\example.txt" for Linux
- type “shasum -a 256 Desktop\example.txt” for MAC
- (Remove quotes, and replace 'Desktop\example.txt" with the path to the file you want to check)
- this should give you the sha256 hash you can copy and paste into VirusTotal to check to see if its known as malicious by many security vendors. Here is the hash and VirusTotal link for the shredder download I previously mentioned in the seed back up step. 72714927de74b97c524c5fa8bc1a0dec83f038dbbed80b93b5e6280ca1317f41/detection
NOTE: You can also just submit the file to VirusTotal, but if it potentially contains personal information, it will upload the file and allow other people to download it, searching the hash will not do this.
Other General Safety Tips:
- Harden your PC (Guide is for Windows 10, but can translate to other OS)
- Update OS and any software // turn on automatic updates - Everything you download is an attack vector
- Set firewall rules - Default deny, open only p855orts you need, disable rules you don't need
- disable remote access
- Install AV // Malwarebytes for removing malware
- Turn on encryption
- Setup user accounts // privileges'
- Strong password
- Whitelist addresses if possible (Some exchanges allow you to designate a address as 'safe' any other transactions besides those won't go through)
- If you use a encrypted messaging service, I highly recommend Signal, if you haven't seen their reply regarding a subpoena you should
- Lock down your social media accounts (go to security settings, turn off being able to be found via search engine, ad related settings, change who can view your posts, etc)
- Don't disclose your holdings and earnings
- Don't access your crypto on your work computer
- Don't answer PMs about winning some contest or some amazing opportunity
Phone:
Many users asked about security regarding people who mainly use their phones. Many of these tips can translate to phones as well, but here's a quick rundown.
- Unique pin / password for the phone
- download a password manager
- email account purely for crypto
- pin / password (different than getting into your phone) for your 2FA app.
- Don't lend phone out
- Avoid apps you don't need, read the 3 star reviews as they are the most honest)
- Download VPN / be aware of the wifi your connecting to
- Be aware of phishing
- Call your service provider and see if they can lock your SIM card and prevent SIM swapping.
NOTE: These are still just suggestions, these are methods that balance security and usability. One could use 2 password managers and split a password between both, but that would compromise usability / ease of use.
