Sensible Security: Four Things That Actually Keep Normal People Safe Online

⬅️ Back to Tutorials

You will finish with four defenses live on your own accounts, in about 30 minutes, for zero dollars. The plan comes from Sensible Security, Ben Stolovitz’s evidence-based guide for normal people, and its best feature is what it tells you to skip.

TLDR:

Turn on two-factor authentication on email, banks, cloud accounts, and social networks, in that order.
Freeze your credit at Equifax, Experian, and TransUnion. It is free.
Switch on automatic backups with version history, ideally a cloud drive you already have.
Switch on automatic updates on every device you own.

Prerequisites: You are logged into your own accounts on your own devices, with your phone nearby for authenticator setup. Nothing to install.

Step 1: Turn on two-factor authentication on the crown jewels

Open security settings for your email first, then banks and finance, then cloud accounts like iCloud, Microsoft, or Google, then social networks. Enable two-factor on each, authenticator app preferred, SMS accepted over nothing. Success looks like a login that asks for a code after your password, plus a set of recovery codes you save somewhere that is not your inbox.

This is the move that matters most in the guide. Breached password databases fuel over 20 million credential-stuffing attempts daily against Microsoft accounts alone, and password strength cannot help you when the attacker already holds your old password. Microsoft’s own measurement: accounts with multi-factor authentication are more than 99.9% less likely to be compromised.

Pro tip: Do email before anything else, even before your bank. Almost every password reset on the internet flows through your inbox, so whoever holds your email holds the master key to the rest.

Step 2: Freeze your credit at all three bureaus

Visit Equifax, Experian, and TransUnion and place a freeze at each. It is free by federal law, takes minutes per bureau, and you temporarily lift it when you apply for credit. Success looks like three confirmation letters or PINs, stored where you can find them.

A freeze stops new accounts opened in your name cold, which is exactly what identity thieves want. Nothing to renew, nothing to pay, no software involved.

Step 3: Switch on automatic backups with version history

Pick the cloud drive you already have: Google Drive, iCloud Drive, or OneDrive. Point your documents and photo libraries at it and confirm two behaviors: deleted files are kept for a window, and old versions of files are restorable. Success test: create a throwaway file, delete it, restore it from the trash or version history.

Stolovitz’s napkin math is what sold me. Roughly 10% of Americans lose a phone yearly, about 10% of hard drives fail within four years, and 7% of business laptops get stolen, which puts data loss on the same scale as online fraud at around 30%. Backups also beat antivirus at its own game: the 2017 WannaCry ransomware was fully defeatable by the patches Microsoft had shipped two months earlier and by any decent backup. Both cheaper than a security suite.

Step 4: Switch on automatic updates everywhere

Phone, laptop, tablet, router if it offers it. Accept the defaults and stop postponing restarts. Success looks like nothing happening: no pending-update badges older than a week.

Updates are unglamorous and they are the patch for the exact attack that made headlines. WannaCry spread through machines missing a two-month-old patch. Auto-update is the whole step.

What not to buy

You might think more security products means more safety, and this is where the guide earns its name by saying no three times. Do not pay for antivirus: built-in Defender tests within a point of paid suites at around 99% effectiveness, and over 10% of third-party installs end up expired or snoozed, which is nearly as bad as none. Do not agonize over password complexity: reuse and phishing beat strength every time, so any reasonable unique password plus two-factor wins. Do not buy a VPN for safety: it moves your trust from the coffee shop to one VPN company, marks your traffic as VPN traffic to everyone nearby, and does nothing once your data leaves the VPN server. Learn HTTPS instead.

If it breaks: Locked out by two-factor with no recovery codes is the classic self-inflicted wound, which is why Step 1 ends with saving them outside your inbox. And a backup you never test-restored is a rumor, so run the throwaway-file test from Step 3 before you need it for real.