Ask HN: How to do a Personal Cybersecurity audit
12 comments
Start with your threat model. Who is the “someone” you’re imagining attacking you? What are the most likely risks to occur? What are the most damaging? Where do those two lists overlap? Prioritise addressing those first. There’s no point worrying about someone stealing your laptop if it rarely leaves the house, but something like not having reliable 2FA on your accounts is probably more likely to get exploited and potentially as damaging. There’s no point worrying about nation state actors exploiting a side-channel to leak data via an LED on your earphones if you’re currently embroiled in a messy divorce.
I just came across this checklist the other day: https://andrew-quinn.me/digital-resiliency-2025-checklist/
In addition to the short checklist, the author has a lengthy blog post describing its implementation in his life: https://andrew-quinn.me/digital-resiliency-2025/
In addition to the short checklist, the author has a lengthy blog post describing its implementation in his life: https://andrew-quinn.me/digital-resiliency-2025/
Don't use chrome to store your passwords. Use a password manager that's not tied to a cloud company that you can use multifactor Auth with, one of which is off device.
Don't leave yourself signed into your accounts. As soon as you're done sign out.
Keep everything portable and not centralised.
Convenience doesn't make for good cyber security.
You can't protect yourself from everything but you can make it more difficult.
Don't leave yourself signed into your accounts. As soon as you're done sign out.
Keep everything portable and not centralised.
Convenience doesn't make for good cyber security.
You can't protect yourself from everything but you can make it more difficult.
A simple starting point for me was checking password reuse and enabling hardware-based 2FA everywhere possible.
It’s surprising how much risk disappears just from that.
I’m wary ofhardware 2fa because I’m prone to losing things. Do you have a plan for if that happens?
I do nearly all my 2FA with Yubikeys, I carry one with me on my keychain and then I have another one in a safe as a backup.
makes sense, I didnt know you could have multiple (learned in this thread)
Start at the fundamentals, dammit!
Do you have off-site backups of all your critical data on a regular schedule?
Do you have physical 2FA on all your accounts?
Are you actively patching/updating all your devices on a schedule, and actively discarding the devices that are too old to patch?
Only after these are done should you start looking at complex phishing and social engineering scenarios. You can successfully mitigate everything you are worried about by nailing these fundamentals.
Do you have off-site backups of all your critical data on a regular schedule?
Do you have physical 2FA on all your accounts?
Are you actively patching/updating all your devices on a schedule, and actively discarding the devices that are too old to patch?
Only after these are done should you start looking at complex phishing and social engineering scenarios. You can successfully mitigate everything you are worried about by nailing these fundamentals.
Do you have suggestions on how to do off site backups? For example for images and documents
XXTB HDD in a safe deposit box. Rotate the disks with on-site backup. Test restore once per year.
Karpathy had an amazing tweet about this if you’re interested in a deep dive.
[1]https://x.com/karpathy/status/1902046003567718810
[1]https://x.com/karpathy/status/1902046003567718810
I would be more careful towards social engineering than some random typical hackers. The former seems more prevalent and successful in my POV.
Even more likely, if I were to get a laptop stolen while unlocked, they could get access to my primary email(s), which could lead them to getting access to accounts via password reset. There were a lot of similar other failure points I used to keep enumerated mentally, but now there's too many to count. The biggest ones are email access however.
Is there a process or method I can use to enumerate/track and fix those kids of failure points in my personal cybersecurity?