Security tools for an ordinary user

How many tools does an ordinary user actually need?

Six categories, and the figure above the page is those six. Category first, example second; do it the other way round and you install a tool whose job you do not know while leaving undone a job whose tool you have not heard of.

The order we suggest, by which two together do the most work: a password manager and a two-factor app. Those two between them neutralise almost every automated attack that reaches an ordinary user, because both rest on one thing: something only you have. Then automatic updates, which is not a tool but a setting and asks nothing of you. Then backup, which prevents no attack at all and is simply the only thing that works after the event. And last, the two least known: DNS filtering and breach alerts.

Our position, which differs from the usual shopping lists: all six categories have an acceptable free option, and for an ordinary user none of them carries a clear reason to spend. What is usually sold is a multi-seat security suite doing three of these six jobs together, generally none of them better than its free counterpart.

And what is not on the list although you expect it: a separate antivirus. Not because it is useless, but because on an up to date operating system that job is already done, and the full answer sits in the lesson on malware and its kinds. There is also a seventh layer that is no tool at all yet matters more than all six, and that is the habits set out in the lesson on browsing safely.

Which password manager? The three things that actually differ

Why length matters more than complexity, and which second factor is safer, is the subject of the lesson on strong passwords and two-factor, where it is set out in detail. The question in this section is a different one and nobody answers it: out of ten programs that all look alike and all say they are secure, which do you install.

Three things actually differ, and the rest of the differences are cosmetic.

First, where the encryption happens. The vault must be encrypted on your own device before it leaves it, so that what sits on the server is a meaningless file. Checking is simple enough: that service own security page must say so in those words. If it does not say it, do not assume it.

Second, and almost nobody looks at it: export. A program you cannot get your own data out of is holding you hostage. Before you put a hundred passwords into it, find the export button once and confirm it exists. It is the only feature you can no longer add at the moment you need it.

Third, the reuse and breach report. This is the only feature that, instead of holding your passwords, shows you your problem: which password you have repeated in several places and which of them have appeared in public breaches. A program without that report is an archive, not a security tool.

And three things that look like they matter and do not: how the program looks, how many features it has, and its rating in the store. What matters instead is that it works on every operating system you actually use, and that its free tier is honest; a free tier limited to a single device destroys the whole point of a password manager.

Our position, which differs from the usual comparison lists: the manager built into your browser is a perfectly defensible choice for most people. Somebody who spends six months looking for the best program while reusing one password everywhere during those six months is worse off than somebody who switched on their browser manager on day one.

The two-factor app: what must you save at the very start?

The recovery codes. That one sentence prevents most of the harm people take from two-factor, and the harm does not come from an attack, it comes from losing the phone. At the moment you switch two-factor on, the service shows you a few one-time codes and most people close that screen. Save them into your password manager right there; it takes thirty seconds and it is the only way back into the account once the phone is gone.

After that, choosing the app itself. The comparison of which method is safer is in the lesson on strong passwords and two-factor; here only one practical criterion matters: pick an app that can move its keys to a new phone. An app without that turns the day you change phones into a whole evening of manual work.

And here there is a genuine choice with a cost on both sides, which ought to be said honestly. Apps that synchronise the keys are more convenient and make losing a phone harmless, but those same keys now also sit somewhere else. For most people the trade goes in favour of convenience, because losing a phone is far likelier than that sync account being broken into. It has one exception though: your main email, which is the recovery key to every other account you hold, is better off with a second factor that does not live with the rest.

The same point applies to the password manager itself: most managers today can also hold two-factor codes. It is convenient and entirely sensible for ordinary accounts, but note that doing it puts both factors behind one lock. For the accounts that matter, keep them apart.

And the rule that sits above all of this comes from the FBI public guidance: never give a verification code to anybody, not by email, not by SMS, not in an encrypted messenger. That same guidance warns that attackers use social engineering to get you to disclose the code, and says in the same place to set up two-factor on any account that allows it and never to disable it. No company, no bank and no support desk asks you for that code.

Backup and updates: why do the dullest have the most effect?

Automatic updating is not a tool but a setting, and on our list it is the only item that asks nothing of you beyond switching it on once. Its effect is also greater than any tool named on this page, because most of the holes that reach an ordinary user had their patch published weeks earlier.

Backup is the only thing on this list that prevents no attack at all. Its use lies elsewhere: it is the only thing that still works after the event, whether the event is ransomware or a phone left in a taxi.

Its rule fits in one sentence: three copies of anything that matters to you, on two different kinds of medium, one of them somewhere else. For an ordinary user that means the file on the phone, one in cloud storage, and one on an external drive that is not always plugged into the computer. That "not always plugged in" matters: ransomware that encrypts your computer encrypts any disk attached at that moment too.

And now the thing we learned ourselves and have not seen said this plainly in any backup guide: a backup is finished when the copy has been verified, not when the upload has finished. The plugin that puts this site backups into cloud storage takes the fingerprint of the file from the destination side after the transfer ends and weighs it against the local copy; in that system, the state "done" means precisely that the fingerprint was read and matched. Nine backup jobs are logged there to date and all nine finished by that same measure; the latest was a file of close to three hundred and fifty megabytes whose transfer took a little over a minute and a half.

Translated for you, whose tools differ although the rule does not: a backup you have never once tried to restore is not a backup, it is a hope. Once a year, bring one file back from the backup and open it. That one small test makes plain the difference between having a backup and believing you have one. The method and its tools are in the lesson on taking backups.

DNS filtering and breach alerts: the two you hear about least

Every time you open an address, your device must first ask which server that name belongs to. DNS filtering works at exactly that moment: if the name is on a list of known malware or fraud domains, no answer comes back and the page never opens at all. Its advantage is that it happens before the browser and before any extension, and it covers every device in the house from one setting on the router. Services such as Quad9 and the family edition of the Cloudflare DNS service do this for free. The mechanism underneath is opened up in the lesson on what DNS is.

Let us state its boundary honestly too: DNS filtering only catches domains already on a list, so it does nothing about a domain registered this morning. And because it works at the level of the domain name, a bad page on a reputable domain slips past it. Which means the very example we gave in the safe browsing lesson would have gone through this filter as well.

The sixth tool is the simplest of all and returns the most for the least work: breach alerts. There are services that gather the list of public breaches and tell you which ones your email appeared in. What you have to do is a one-off: enter your address and, if you wish, switch on the alert so that they tell you about the next breach.

And what you must do afterwards is the thing most people do not: changing the password on that one service is not enough. If you had the same password anywhere else, all those places have to change too. Which is why the reuse report in a password manager, mentioned in the second section, is the natural partner of this tool.

And if we are to turn this page into a single action: go and count how many of these six categories you already have. Our experience is that most people have four switched on without knowing it, and the two that are missing are almost always the same two: a backup nobody has tested, and recovery codes that were never saved. Counting comes before reading.