Account Security
A spare security key has to be enrolled before it can rescue a login
Buying a spare security key is not enough. Register and test it with each supported account, then store it separately from your everyday key.
ACCOUNTS · DEVICES · PRIVACY
Account Security
Review recovery methods and backup codes while you still have access, then store recovery material somewhere separate from the device it protects.
Account Security
Encrypted DNS protects one part of a browser request, not every detail
DNS over HTTPS encrypts the lookup between a browser and its DNS resolver. Understand what that protects and what it does not hide about browsing.
Account Security
A DKIM signature does not make every email request trustworthy
DKIM authenticates a signing domain and protected message content. It does not prove that an email’s request is honest or that the named sender authorised it.
Account Security
An Old Device Can Stay Signed In After You Stop Using It
Review old account sessions before selling, retiring or forgetting a device, and distinguish signing out from deleting the data stored on it.
Account Security
An Unexpected MFA Prompt Is a Reason to Pause
An MFA approval request you did not initiate deserves a careful response. Reject it, check your account through a trusted route and strengthen authentication.
Account Security
If Your Phone Disappeared Today, Could You Still Sign In?
Review recovery methods and backup codes while you still have access, then store recovery material somewhere separate from the device it protects.