My Security and Privacy Checklist: 2025 Edition

Last year, I published my Cybersecurity Checklist for friends and family. As the year progressed and more news came to light about significant company security breaches (like the AT&T data hack), I took additional actions to protect my security and privacy. Recent news events (such as the messages that revealed the Blake Lively smear campaign) also got me thinking more about large-scale surveillance. I'm not a paranoid person — but I am a realist. And real-world events create situations where our online lives are more likely to be used in ways we did not intend, but can foresee. If you are thinking about the risks of digital life today, but don't know where to start, use this checklist to take precautions. An explanation of each checklist item is included below.

Security Checklist

• Use a Password Manager to generate and store passwords
• Use 2FA to secure your accounts
• Change your passwords
• Set up an additional PIN and passcode for your phone
• Freeze your credit
• Agree on a family passphrase
• Install a mesh network app (Bridgefy) in case of an emergency situation where you can't connect to the Internet

Privacy Checklist

• Switch to Brave Browser on your computer and iPhone
• Update your Google AdCenter Settings
• Subscribe to Incogni
• Always choose "Ask App not to Track" when installing new apps on your phone
• Always select "Do not sell my information" on website cookie preferences

Surveillance Checklist

• Set Messages to expire in 30 days
• Use a messaging app with end-to-end encryption, like Signal
• Learn what a VPN is and whether you should use one
• Request Public Internet Photos (California Only)
• Remove or replace profile photos
• Support independent journalism

Password manager

If you use an iPhone, use the password manager that comes with your phone. This will make it easy for you to log in to your accounts, and you will always know where to look for your passwords. Apple provides excellent encryption, so your passwords are backed up and secure. If you use this option, ensure you have a PIN or password on your phone. You wouldn't want someone to pick up your phone and have access to all that information!

If you need to manage passwords for yourself and family members, invest in a service that allows you to manage passwords across all your devices. Many competitive products, such as Dashlane and 1Password, have a strong track record for security and good user experience. Once you get a password manager, follow the instructions for creating a strong password and Two-Factor Authentication.

Start using Two-Factor Authentication (2FA)

Think of Two-Factor Authentication (2FA) like this: Imagine you're coming home and have a sturdy security guard waiting by your front door. When you arrive, the guard first asks you for your password, and once you've shared that, he also asks for your house key. You need to use both the password and the physical key to get inside your home. This is what we mean by two steps — the "second factor" — needed to make sure you're really you. It's a great way to keep your home (and your online accounts) safe. And just like there are different kinds of keys for your house, there are various ways to do 2FA.

1. Hardware Key: a physical key you insert in your computer or phone. Tap to unlock. I recommend YubiKey, and buying at least two. Keep one of the keys as a backup in a very safe place, like a lock box or safe, and keep the other with you at your desk or when you travel. This is the most secure option.
2. Authenticator App: an app on your phone that generates a new six-digit code every 30 seconds. When you log in, you also enter the code from the app. If the code matches your account, you're in. Be aware: if you upgrade or change phones, confirm that the Authenticator works on your new phone before wiping and getting rid of your old phone.
3. Text Message: after you enter your username and password, the site sends you a four to six-digit code to the phone number they have on file for you. The code arrives by text message, you enter it, and you're in. However, if you no longer have access to your phone, you won't get the text message. Or, if someone else has your phone, they can see the code. In a worst-case scenario, if someone has stolen your SIM, they will get the code and know which account you're logging in to, and at that moment, they could take over your account by logging in, changing your email and password, and taking complete control. It's rare, but it does happen. Which brings me to my next point.

Change your passwords

Which accounts would be disastrous if they were ever taken over? In my case, I thought of my email, bank, and retirement account. Go to the website for each of these accounts and start reading up on their security. Can you use a hardware key like a YubiKey for extra security? Do they offer 2FA with an Authenticator app? Can you change your username to something only you would know that is different from your email address or your first and last name? Get this done as soon as you can. Hackers don't send out a press release when a security breach happens. When companies announce an issue, it's usually about an event that occurred in the past 3–6 months or even a year ago. Please do it now and don't wait.

Now that you've tightened your big accounts, think through the remaining top 10–20 accounts, like social media. Set aside some time to update the passwords for these accounts, making sure that your email, phone number, and personal information are up-to-date.

The best practice is to change passwords on these accounts every 1–2 years. Again, this is a good reason to have a password manager so that you can easily create new secure passwords and see when they were last updated. If you haven't changed your password for an account in the last few years, it's almost certain this information is available on the dark web for someone to buy and try.

If you haven't changed your password for an account in the last few years, it's almost certainly for sale on the dark web

Set up a SIM PIN and passcode with your phone carrier

Did you know you can protect your phone's SIM by assigning a PIN to it? This is the best way to prevent someone from taking over your phone number. By assigning a PIN code, you must use this additional code whenever you restart your phone or upgrade your software. It would be tough for anyone to steal or copy your SIM without knowing your PIN because the SIM will be blocked if the PIN is entered incorrectly three times.

Additionally, your phone carrier (like AT&T, Verizon, etc.) may offer the option to assign a numeric passcode to your account. This provides extra protection to prevent someone from impersonating you or someone on your account from taking over your device. When you call your phone carrier to make a change, the customer service representative will verify your identity and request the passcode before making changes.

Freeze your Credit

In my previous job as a UX Designer, I created many credit applications, so I know how easy it is to apply for credit. All you need is a name, address, birth date, and last four digits of a social security number. These days, it's pretty simple to freeze your credit with the big three companies: Equifax, Experian, and TransUnion. And, if I ever do need to apply for a loan, it's easy to unfreeze it — I need to give the credit agencies a few business days for the request.

Create a Family Passphrase

With Deep Fakes, scammers can now easily create an AI-generated version of your loved one's voice. So, it's a good idea to have a predefined family passphrase. If you get an urgent call from a family member prompting you to wire money or take immediate action, you can ask for this passphrase. It's something that security experts call "Polite Paranoia," which allows you to have a conversation in a way where you are concerned about your loved one while still being cautious. "Of course, I'm 100% ready to help you. What's the passphrase we agreed on as a family?" Remember that scammers will have an excuse like they can't remember because of the situation's urgency. Make sure that the passphrase is memorable and unique for your family. Practice it and remind one another every six months. With the ability for scams to sound and look more realistic every day, you need to assure yourself that a phone call from someone who sounds exactly like a family member is actually who you think they are.

Practice polite paranoia — "Of course I'm 100% ready to help you. What's the passphrase we agreed on as a family?"

Download Bridgefy for mesh networks

During a time of crisis, the Internet may become unavailable. Wind storms, fires, or earthquakes could temporarily cut off your connection. If you're prepared, you can communicate with others in a local area with a mesh network app like Bridgefy. Mesh networks are decentralized and consist of many devices that connect directly to one another, forming a network. If you and others in your area have downloaded Bridgefy on your phone before an internet shutdown, you can participate in local communication during an emergency.

Use Brave, a Browser without Ad Tracking

Even after many changes to my privacy settings, I've stopped using the Google Chrome browser and transitioned to Brave Browser. It looks and feels like Chrome but without the ad tracking (although it does display advertising on the home page). So far, I like the familiarity of the tabs, groups, and backgrounds. Brave feels similar to Chrome because it is built atop Chromium, which is the same open-source browser project as Chrome. It's also fully compatible with my favorite Chrome extensions: Evernote, Grammarly, Paperpile, Pocket, Awesome Screen Shot, and my password manager.

Google Account: Update MyAdCenter Settings

This is the longest section because Google's primary business model is advertising. It's why they are so successful and continue to build new advertising features and functionality. But if you don't like being tracked, Google offers some options to reduce the amount of monitoring they do. Most of this is within Google's Settings, in the Update Sharing for Ads on Google profile section. Here's what I did.

You can edit your advertising settings at https://myadcenter.google.com/home. As of this writing, there are three sections: My Ads (skip this), Customize Ads (some work for you to do here), and Manage privacy (definitely look at this one).

In the "Manage Privacy" tab, turn OFF all activity used to personalize ads. Turn off Web and App activity. Turn off YouTube history. Turn Off "Areas where you've used Google." Now, doing this will not turn off all ad personalization. You probably wouldn't like to experience Google without any personalization whatsoever. We're trying to minimize the amount of data that Google collects on you to sell ad space to advertisers who want to get in front of people doing things on the web that are adjacent to their products.

For example, let's say that you recently learn that your uncle was diagnosed with diabetes, and so you do a search for "diabetes" to learn more. Suddenly, you start seeing drug advertisements everywhere you look. It's because drug companies are paying Google to advertise in front of you. In 2021, pharmaceutical companies in the United States spent $6.88 billion on direct-to-consumer advertising. I get why that happens. However, my curiosity and concern for my family is my private business.

Also, think carefully about what you do and do not want Google to use to identify you when selling advertising to brands. Because I don't wish to get totally random ads, I did keep some of this information ON, such as gender, age, language, and "in a relationship," because I'm happily married and don't want to see ads for singles. But I left many other categories off because I don't think Google needs to know my household income, my education level, my professional industry, my employer size, whether or not I own a home, and whether or not I'm a parent.

Next, go into Google's "Customize Ads" section and look at the Topics, Brands, and Sensitive categories. You'll see the types and brands that Google considers you interested in. There's not much to do here, but I would recommend looking at the Sensitive category and at least modifying the category labeled "Dating" so that you don't get singles ads if you don't want them.

Go back to that Data and Privacy page (https://myaccount.google.com/data-and-privacy) and scroll down to "Personalized Ads," and you'll see something called "Partner ads settings: Options for ads on sites that partner with Google." Here's Google's money-maker feature: personalized ads on sites that partner with Google. Those sites are not paying to advertise, they are getting paid by Google to serve you personalized ads. That's what business people call a "flywheel," where the company is making money selling to more than one party in the ecosystem. Here, Google is selling the advertising and selling the platform to display the advertising on other websites. I turned this feature off, but I may turn it back on if I start getting ads for things I don't like on Google partner websites.

Keep in mind that other companies are also venturing into Google's core competency. Amazon's advertising is just as exploitative, and I have yet to find a place to update what kinds of ads I don't want to see on Amazon Prime Video.

I will emphasize that Google is not all bad. They do some things very well. In fact, they have exceptional security controls (See my original Cybersecurity Checklist). Using the recommended 2FA solutions (Passkeys or hardware tokens like Yubikey) with your Gmail account can considerably minimize your risk of account takeover. Google has also recently upgraded their login for third-party apps in the past few years. This is the kind of confidence I'm looking for. Lastly, I feel like Google has a realistic digital legacy plan, with a way for your account to be transferred to a person you choose if you become incapacitated or pass away. Every few months, I get a reminder that my account is ready to be accessed by the person I've selected if anything should happen to me. I find this to be both a reassuring and grim reminder of my mortality!

Subscribe to a Service that Removes Personally-Identifying Information

This was a recommendation I put into last year's Cybersecurity Checklist. Get signed up for a service that removes your personal information from the Internet. I recommend using Incogni or DeleteMe. Both are excellent options. These services work day and night to remove your information from databases that store your name, age, and address, as well as other info associated with you available on the Internet, which are frequently sold to marketers. In the past 18 months, my name and email have been removed from over 500 data broker databases. It won't prevent identity theft, but it's certainly done a lot to reduce my identity footprint.

"Ask App not to Track"

When you install a new app on your phone, you will typically get an alert asking if it's okay for the app to track your behavior. Always choose the option not to track your activity. If you don't choose this, apps can potentially see your actions within other apps, including your browser history and activity in anything on your phone. I see no reason to share this information between companies, especially since it's just helping a company sell targeted advertising.

"Do Not Sell My Information"

When you see that annoying cookie banner at the bottom of a webpage, please don't dismiss it. Take a few moments to decline tracking for ads. See what you can request not to be tracked about yourself. It's valuable for companies to turn your information into something to sell to advertisers. You aren't receiving any financial benefit. Take back your identity. It's work, but it's yours, not theirs, to profit from.

Messaging App Settings: Keep Messages 30 Days

After the FBI made the recommendation to use encrypted messaging, the first thing I did was review my settings in my iPhone Messaging app. In Settings > Apps > Messages, you should change the following settings. In Message History, change this setting to Keep Messages 30 Days. This is to limit the number of messages that could be read by a bad actor if the network you've been using has been hacked (such as in the case of AT&T's data breach). Also, it prevents the government from being able to subpoena a long history of your text messages going back years. I'm not involved in anything nefarious, but I prefer not to have my life's conversations stored by a company I don't trust to keep away from the prying eyes of hackers or the mandated sharing that can be enforced by a government subpoena.

iPhone's Messaging App: Look for the BLUE background

When texting another iPhone user, you can tell that your text is encrypted because it will have a BLUE background. The green messages may or may not be encrypted. There are a lot of factors to consider, but you can feel safe knowing that your blue text messages can't be read by anyone other than the intended recipient. Even your phone network (like AT&T) can't read them.

If you need a messaging app with end-to-end encryption, use Signal

Ideally, and this was the recommendation from the FBI, if you don't want anyone to read your messages, you should use a fully encrypted messaging app, such as Signal. This is a recommendation for anyone who works in the government or works at a company where there might be a risk of corporate espionage. Neither applies to me, so I'm not taking this recommendation.

Signal was founded in 2013 and is now developed and maintained by the non-profit Signal Foundation. It supports end-to-end encryption, meaning only the participants in the conversation can read or hear messages, not the ISP or the phone carriers. Signal is recognized by journalists and security experts as a solution for ensuring your communications are private and secure. There's no downside to using Signal; you just need to get anyone you want to converse with to use it, too. In my family, that's still too much inertia.

What is a VPN? Do you need one?

A Virtual Private Network (VPN) is a way to make your browsing behavior appear to be coming from a location you choose instead of where you are. Typically, your internet provider can see the traffic entering and exiting your modem and can read what websites you're visiting. Your activity is hidden from your internet service provider when you use a VPN. When you request content from a third party (like Netflix), it will change your address to make it look like you are coming from a different location. So, if you want to see a movie only available in France, you could use a VPN to make Netflix think you're coming from France, even if you're in the US. A VPN is useful in places where the government is blocking access to certain information so that you can get around censorship that might be happening.

A VPN isn't going to encrypt information — it's no more secure than a standard connection to the Internet. And, if you are using a VPN, but logging into websites where you have already validated credentials, it's likely not going to be useful at all. For example, if you've indicated in your Netflix profile that you live in the US, they might not show you that French movie anyway. However, as authoritarian governments restrict content, citizens can still access information using a VPN. If you suspect your state or federal government is blocking content you want to see, it's time to use a VPN. The Brave Browser has a built-in VPN that can be turned on or off.

Request & Remove Public Internet Photos (California Only)

I live in California, so I was recently able to request a copy of all the images of me on the Internet that the company Clearview (https://www.clearview.ai ) has collected and used to create a database of identities that they may or may not be selling back to law enforcement or other government agencies. I was certainly surprised to receive a 16-page PDF file of all the images of my face that are out there, and it made me rethink how I would like to identify myself on various platforms across the web.

If you're wondering why I can do this in California, but you don't have this privilege in your own state, it's because of the California Consumer Privacy Act, CCPA, enacted in 2018. This act is based on the concepts of transparency, user rights, accountability, and non-discrimination. Write to your state legislators and tell them to protect your privacy.

Strategically Replace Profile Photos

My first instinct after seeing all my photos on the Internet was to remove everything, but there are some services (LinkedIn and Medium) where I didn't. These are my professional identities, and my photo is public there to help me network and stay top of mind with my professional contacts. That's still important to me, so I am going to live with the knowledge that my photo is available on these platforms.

I did change my photo to either an icon or something else that wasn't a photo on Facebook, Instagram, X, Google, and Gmail. Think about all the places your photo appears, and consider if you want that photo in a database that a company is preparing and likely selling to institutions that will use it as a way to identify your participation in things like public transportation, travel behavior, or visiting public places. I don't like this idea of corporations creating a database with my photo in it for searching, not because I'm doing anything illegal, but because I'm a private person, and I don't appreciate any organization tracking my activity and making decisions about me without my input.

Support Independent Journalism

Journalism in 2025 is nothing like journalism five or ten years ago. Many media outlets have either consolidated or become technology companies with journalism on the side. This trend has started a counter-trend, with journalists breaking out on their own or banding together in small groups. This is easier today with platforms like Substack, YouTube, WordPress, Instagram, and podcasting tools. With so many good journalists going independent, many now offer subscriptions or sponsorships. I found a few outlets I value to the point where I've decided to back them with financial support. My favorites are 404 Media (technology reporting) and Molly White's Citation Needed (crypto). Look for the people and voices you trust, and spend a little money to ensure journalism with a strong independent and investigative focus will continue into the future.