Password management and multi-factor authentication
Password security is not about changing them often; it is about sufficient length and never reusing them. Once one service is breached, attackers replay the same credentials against other services — an approach that is fully automated and works far too often. A password manager generating a unique long password per service is the direct solution.
Multi-factor authentication adds a second barrier beyond the password. Codes from an authenticator app are preferable to SMS, which can be intercepted or bypassed through SIM-swap attacks. Where a service supports hardware security keys or passkeys, those are usually both safer and more convenient.
Recognising phishing and social engineering
Today’s phishing messages contain no obvious language errors and will often use your real name and genuine details. So the test should not be whether the wording looks right, but whether the process itself makes sense: legitimate institutions do not ask you to complete verification by tapping a link in a text, and do not resolve delivery or tax issues by requesting a full card number and security code.
The most dependable habit is never to follow the link in the message, but to open the official site or app yourself and check there. Anything that manufactures time pressure, threatens account suspension, or asks you to install remote-assistance software should be treated as high risk and stopped immediately.
Encrypted connections and public networks
Nearly all websites now use HTTPS, so page content is already encrypted in transit and browsing on public Wi-Fi is considerably less risky than it once was. What still deserves attention is connecting to a counterfeit hotspot, and confirming the address is correct before doing anything sensitive on a public network.
A VPN routes your traffic through a provider and hides your source address, which suits avoiding observation by your network operator or reaching region-restricted resources. It does not protect you from phishing or malware. And when you choose one, the provider’s own logging policy and trustworthiness become a new risk to assess.
Browser and mobile settings that matter
In the browser, three low-effort measures pay off clearly: keep it on automatic updates, review and remove extensions you no longer use (their permissions are often far broader than expected), and block third-party tracking cookies. Avoid storing high-value passwords in the browser itself; keep them in a password manager instead.
On mobile, the priority is periodically reviewing app permissions — location, microphone, camera and contacts should be granted only where genuinely needed. Installing only from the official store, avoiding sideloaded packages of unknown origin, and enabling device encryption and find-my-device substantially reduce the exposure if the device is lost.
- A unique long password per service, held in a password manager
- Multi-factor authentication everywhere, preferring an authenticator app or passkeys
- Never reach a login page through a link in a message
- Review browser extensions and mobile app permissions regularly
- Enable device encryption and remote wipe
Being deliberate about personal data
The most effective way to limit the impact of a breach is to hand over less data in the first place. Question whether required fields are reasonable when signing up, avoid using your primary address for low-trust services, and periodically close accounts you no longer use, since they usually still hold your details.
Taiwan’s Personal Data Protection Act sets clear rules for collecting, processing and using personal data, and individuals may request access, correction or deletion of their own records. For organisations, stating the purpose of collection, limiting internal access and genuinely deleting data at the end of its life also reduce their own exposure.