A woman at a cafe, wearing headphones and watching something on her laptop.
Sometimes, starting is the hardest part. Taking one action, one step, and then another after that. Whether you’re preparing for a walk, a social event, or living in an era of unprecedented events, your privacy and security matters.
Let’s take a small privacy step today. Start with your primary email account, that account you use for utilities, calendars, socials, and a catch-all for your everyday life. You know, the one account to rule them all.
If that account gets breached, and you no longer have access, what would that mean for you? To take it a step further, how would you function without access to that account?
Key Takeaways
- Identify your threat model so you know what you’re trying to protect.
- Create long and unique passwords, use a password manager, if it make sense for you.
- Enable two-factor authentication on your accounts when possible.
- Check where you’re logged in and revoke access to third party apps.
- Use our free Quick Start Privacy Guide to jump start your account security.
Know Your Threat Model
Your accounts are part of your overall threat model, they let you access other accounts, login to services, track expenses, manage your tools, business, family activities. Make a list of where you use your primary email address (this might take a few minutes), so that you can decide where to delete logins.
Once you have your list of accounts in hand, make sure you also have a secondary email account that you don’t mind using for social media and newsletters. This secondary account could be your recovery email, or a catchall that you don’t want clogging up your main account. Ideally, you’d be using different email aliases and throwaway accounts for each thing you sign up for, but let’s not get ahead of ourselves.
The idea is to minimize damage done if your primary account is compromised, you won’t have all your data in one critical account. Basically, you’re compartmentalizing your risk, that way if a data breach happens, you make it easier to recover a compromised account. Do your best not to share your primary email account with others, or publicly, this also helps reduce your risk.
Create and Manage Secure Email Passwords
Keep your primary email account secure by using a long and unique password, and if it’s right for you, then consider a password manager. (We like Bitwarden and 1Password for managing our passwords.) If writing down a password in a notebook is easier for you, that’s great, remember to store it away from your computer.
Do what makes sense for you, know your threat model, and who has access to your devices. For example, if you are in a harassment, stalking or domestic abuse situation, your devices could be monitored by the abuser. In this case, any communications, passwords, and accounts on that device should be considered compromised.
Make sure you use different passwords for each of your accounts, and don’t repeat old passwords or combinations. If someone has your password for one account, they’ll try it with other accounts connected to you or your name.
Enable Two-Factor Authentication
Once you’ve got a solid password, let’s enable two-factor authentication (2FA) for your primary email account. Two-factor authentication adds a second method of verification, which means it requires something you know, your password, and something you have (a code, a device, or physical key). There a few ways enable 2FA, including using an authenticator app, such as Authy, Google Authenticator, Microsoft Authenticator, or a physical security key, such as Yubikey. You can also enable MFA by providing a phone number or email address to receive the code that enables you to log into your accounts.
When you enable 2FA, your email provider generates backup codes. Store those codes in your password manager, or print them and store them somewhere safely. If all methods of accessing your email fail, you’ll still have those codes. Having a backup is essential, even for your email.
Many financial institutions still primarily use text, or email based authentication, and it may be the only option. Something is still better than nothing. It’s about layering your security, so that the next time someone’s looking to steal logins, it won’t be you.
Now that you’ve enabled 2FA, review any security notifications for your account, or logins you don’t recognize. Usually, the security notifications are also sent to a secondary account to which you have access, and can help you determine if it was you who logged in, or someone else.
Check Connected Third-Party Apps
Review the third-party apps that have access to your account. Revoke access for any service, app, or location you don’t recognize. Here are some email providers you may use already, and the pages where you can check which apps have access tokens to your account:
Gmail: myaccount.google.com → Security → Third-party apps with account access
Microsoft Outlook: account.microsoft.com → Privacy → App permissions
Apple ID: Settings → [Your Name] → Password & Security → Apps Using Apple ID
Yahoo Mail → Account Security → Manage app passwords
In addition to third party apps, be careful about where you save your passwords, use your in-browser password manager (1Password has an extension) instead of the browser itself. The best practice is to log out of your accounts and browsers when you are finished checking your emails. Don’t allow the browser to remember your password, particularly on devices you don’t own. This permission request will often show up as a “Do you trust this browsers?” Choose “no.”
Final Thoughts
Securing your email helps keep your other online accounts safer. Make sure you use good password management and enable 2FA whenever possible. The more security you layer now, the less likely you’ll get hacked later. Even if your credentials are part of a breach, having 2FA helps prevent anyone from gaining access to your account.
Finally, if you need a place to get started, try our Quick Start Privacy Guide (it’s free) to keep track of your account lists, and to keep your notes together.