If passwords feel like house keys you've copied a hundred times and tossed into a dozen junk drawers, you're not imagining it. Passwords get reused, guessed, phished, and leaked, then we all get stuck playing the reset game at 2 a.m.
That's why passwordless passkeys are such a big deal, marking the transition to a modern login standard. They let me sign in using my device (and biometric authentication with my face, finger, or PIN) instead of typing a secret string that can be stolen. Better yet, passkeys are now a first-class login option for Google, Apple, and Microsoft accounts as of March 2026.
In this post, I'll explain what passkeys are, how they work, and what setup really looks like across the big three. I'll also cover the parts that can surprise you, like recovery and shared devices.
What Passwordless Passkeys Are and Why They Beat Passwords
A passkey is a login credential built on public-key cryptography from the FIDO Alliance (often described under the FIDO2 and WebAuthn standards). That sounds intense, but the day-to-day experience is simple: you choose a passkey at sign-in, your device asks for Face ID, Touch ID, fingerprint, or a device PIN, then you're in.
Here's the key idea: a passkey can't be "typed" into a fake site. With passwords, a phishing page just needs to look convincing long enough for you to hand over the goods. With passkeys, the sign-in is tied to the real site's domain, so the fake page can't trick your device into completing the login the same way, making passkeys phishing resistant.
Also, your biometric data isn't getting shipped off to Google or Apple or Microsoft. Your face or fingerprint is just the "unlock button" for a cryptographic key stored on your device. The site never receives your fingerprint. It receives proof that your device has the right key.
So why are passkeys showing up everywhere now? Because they reduce two ugly problems at once:
Phishing gets much harder because there's no password to steal and replay.
Credential leaks hurt less because servers store public keys, not reusable secrets (passkeys also thwart credential stuffing attacks that automate mass logins with stolen credentials).
Passwords aren't dead yet, but passkeys are finally practical for normal people, not just security nerds.
How Passkeys Work When I Tap "Sign In" (No Math Required)
When I create a passkey for an account, my device generates a pair of keys:
A public key that the service can store.
A private key that stays on my device (or in my device's synced credential manager).
During login, the site sends a challenge. My device signs it using the private key, after I complete user verification to unlock that key with Face ID, Touch ID, a fingerprint scan, or by entering my screen lock PIN. This is asymmetric cryptography at work. The site checks the signature with the public key it already has. If it matches, I'm authenticated.
That's it. No shared secrets. Nothing reusable for an attacker to copy-paste later.
I explain it to families like this: a password is like telling the bouncer a phrase. A passkey is like showing up with a tamper-proof badge that only works at the right door, in the right building. A scammer can copy your phrase. That same scammer can't copy your badge from across the street.
One more detail that matters: passkeys often sync. That's why they feel "magical" after you set them up on one device. Apple syncs them through iCloud Keychain (now surfaced in the Passwords app). Google syncs them through Google Password Manager. Microsoft can store and use them through Windows Hello and the Microsoft Authenticator app, depending on platform and account type.
If you remember one thing, make it this: passkeys protect you from the "I typed my password into a perfect fake" problem, because the login is bound to the real site.
Passkeys on Google, Apple, and Microsoft Accounts (What Setup Looks Like in 2026)
The good news is that Google, Apple, and Microsoft all support passkeys broadly now. The "gotcha" is that each one stores and syncs them a bit differently, so the experience depends on what devices you actually use.
Before I get into each provider, this is the basic flow I see most often:
I sign in normally once (or confirm it's me).
The account prompts me to create a passkey.
My device asks for Face ID, Touch ID, fingerprint, or device PIN.
Next time, I pick passkey and confirm with biometrics.
Google Passkeys (Google Account and Gmail)
As of early 2026, Google passkeys work on Android 9+, ChromeOS 109+, and on Apple devices when you use Chrome. They save to Google Password Manager, which can sync across your signed-in devices.
In practice, I'll create a passkey from my Google account security settings or when Google prompts me during sign-in. After that, the login is usually: enter my email address, then approve with my phone's fingerprint or face unlock. On laptops, it often hands off to my phone or uses a local method if supported.
Where Google shines is friction. If you're already living inside Android and Chrome, passkeys can feel like the default fast path.
Where people trip up is mixed-device life. If your day is "Windows laptop at work, iPhone at home," you'll still get passkeys working (with a QR code for cross-device sign-in on non-Android hardware), but you may see more QR handoffs and device prompts.
Apple supports passkeys on iOS 16+ and macOS Ventura+. They're stored in Apple's credential system and show up in the Passwords app, syncing through iCloud Keychain (end-to-end encrypted, assuming you use it).
For most people, Apple makes passkeys feel invisible. I'll be on Safari, I'll tap "Continue with passkey," Face ID pops, and I'm done. On Mac, Touch ID and the system login prompt handle it.
The best part is consistency. The same Face ID you already trust for unlock and Apple Pay becomes the approval for sign-in. That's comforting for parents and non-technical users because it feels familiar.
The main limitation is the same one Apple always has: you'll get the smoothest ride inside the Apple ecosystem. If you bounce between Apple hardware and non-Apple devices, you can still use passkeys, but the handoff steps matter more.
Microsoft Passkeys (Microsoft Account, Windows Hello, Authenticator)
Microsoft supports passkeys on Windows 10+ (and Windows 11), plus mobile support through Microsoft Authenticator on iOS 17+ and Android 14+ in common setups. On Windows, Windows Hello becomes the star of the show (face, fingerprint, or PIN).
In real life, this means I can sign into my Microsoft account and approve with Windows Hello, without ever typing a password again on that device. On mobile, I may create and use these digital credentials through Authenticator, which is also handy when I'm signing into Microsoft services on another device.
Microsoft's world has two flavors: personal Microsoft accounts and work or school accounts tied to Microsoft Entra ID. FIDO2-based passkeys are showing up in both, but your organization can set rules. If you're a security pro reading this, that policy angle is where your rollout plan lives or dies.
If you want a quick comparison mindset for whether passkeys replace passwords outright or sit beside them for a while, this guide on passkeys vs passwords and what changes summarizes the tradeoffs clearly.
The Stuff People Don't Tell You: Account Recovery, Backups, and Shared Devices
Passkeys feel like magic right up until the day you lose your phone, break your laptop, or need to sign in on a borrowed device. Then you find out whether you planned the account recovery "what if" part.
Here's how I keep it sane.
First, I treat passkeys as the primary login, not the only login. Most services still keep passwords as a fallback, and that's fine. It's like having a spare key in a lockbox. I just don't want that spare key to be my daily routine.
Second, I keep strong account recovery options. That usually means up-to-date recovery email and phone, plus more than one trusted device where possible. For high-security accounts, device-bound passkeys or physical security keys add an extra layer since they don't sync across devices. If you only have one device that can approve logins, you've built a single point of failure.
Third, I think hard about shared devices. A family iPad, a classroom Mac, a lab PC, these can get messy because the passkey is protected by whoever can unlock the device. If your kid knows the tablet PIN, they may also be able to authenticate you in some contexts. That's not always a disaster, but it's something to decide on purpose.
This is also where classic multi-factor authentication guidance still matters. Passkeys reduce phishing risk, but I still want layered protection for important accounts, especially when recovery paths get involved. If you need a refresher, I've got a straight talk version of two-factor authentication basics that explains why extra factors still help.
One more "real world" warning: public Wi-Fi login pages are a favorite trap for credential theft. If a hotel portal ever asks for your Google, Apple, or Microsoft password, I treat that as a giant red flag. Passkeys help here because you're less likely to type anything secret into a fake page, but you still need to recognize the setup. My deeper breakdown on spotting fake Wi-Fi login pages is worth a quick read if you travel.
Passkeys reduce risk, but recovery settings decide how bad a bad day becomes.
How I Recommend Switching to Passkeys Without Breaking Your Life
I like passkeys, and I'm using them more every month as part of the broader shift to passwordless authentication. Still, I don't treat this like a switch I flip once and forget. I treat it like upgrading the locks on my house while I'm still living in it.
My practical approach looks like this:
I start with my most abused accounts: email and cloud identity. That's Google, Apple ID, and Microsoft. Those accounts often reset everything else, so they deserve the strongest login with passkeys.
Next, I set passkeys on at least two devices when I can, using CTAP so they communicate securely to complete a login. For example, phone plus laptop, or phone plus tablet. That way, a lost phone isn't an automatic crisis.
After that, I clean up my password habits instead of pretending passwords are gone. A password manager still matters for the many sites that don't support passkeys yet. Also, I keep unique passwords for the services that remain password-based.
Finally, I keep 2FA enabled where it makes sense, especially on social accounts that get targeted for takeovers. If you want a quick walk-through for the apps families actually use, this guide to set up 2FA on social media is a solid weekend project.
For the "are we really near the end of passwords?" angle, I like this perspective on the rise of passwordless authentication in 2026. It matches my take: passkeys are the direction, but the transition to passwordless authentication is uneven.
Conclusion
Passwords had a long run, but passwordless passkeys are the first replacement that feels both safer and easier. Google, Apple, and Microsoft now support them widely, so you can use face recognition, a fingerprint sensor, or device PIN to sign in without handing attackers something reusable. My advice is simple: enable passkeys for your core accounts, set up recovery like you mean it, and keep a password manager for the rest. If you do that, you'll spend a lot less time resetting logins, and a lot more time actually using your tech.
You know that moment when you connect to “Free Airport Wi‑Fi” and a page pops up asking you to accept terms? That page is a captive portal, and most of the time it’s harmless. Still, it’s also a perfect place for scammers to set a trap.
Captive portal attacks are sneaky because they don’t need to “hack” your phone in a movie-style way. They just need you to trust the wrong Wi‑Fi network, then hand over something valuable on a look-alike login page.
I travel, teach, and troubleshoot security issues for a living, and public Wi‑Fi is one of those “it’s fine until it isn’t” situations. Here’s how captive portals work, how attackers fake them, and what I watch for in airports and hotels.
What a Captive Portal Really Is (And Why It Exists)
A captive portal is a web page you’re forced to see before the network lets you browse normally. It’s basically a bouncer at the door.
On legitimate networks, captive portals are used for things like:
Accepting terms and conditions
Entering a room number and last name (common in hotels)
Paying for access, or entering a voucher code
Tracking usage or limiting time per device
The important part: a captive portal is not “the internet.” It’s just a local web page served by whoever controls the Wi‑Fi. That’s why it’s such an attractive target.
How Captive Portal Attacks Work in Airports and Hotels
When I explain this to non-security friends, I use a coffee shop analogy.
A real captive portal is the cashier asking for payment. A fake captive portal is someone in a convincing apron standing near the line, taking credit cards, and smiling as if they belong.
Most captive portal attacks start with one of these setups:
The “Evil Twin” Wi‑Fi Network
An attacker creates a Wi‑Fi network that looks official, for example:
“Airport Free WiFi”
“Hotel Guest”
“Marriott Bonvoy WiFi”
“Hilton Honors 5G”
Your device sees a strong signal, you tap it, and you’re connected to the attacker’s access point instead of the real one.
Sometimes they even add a second network with a similar name, counting on you to pick the wrong one when you’re tired, late, or juggling kids and luggage.
The Fake Captive Portal Page
Once you connect, the attacker redirects you to a page that appears to be a normal “Sign in to Wi‑Fi” screen. Then they ask for something they shouldn’t need, like:
Your email and password (especially a Google, Apple, or Microsoft login)
A “work login” prompt
A request to download an “internet certificate,” profile, or app
If you enter credentials, the attacker can steal them. If you install something, things can get worse fast.
The Quiet Part, Traffic Snooping
Even if you don’t type a password into the portal, a hostile network can still watch and manipulate traffic in certain cases, especially if a site isn’t using HTTPS correctly.
This is why I’m strict about staying in HTTPS land when I’m on public Wi‑Fi. The EFF’s HTTPS resources explain why encrypted web traffic matters and what it protects.
Red Flags I Watch for on Airport and Hotel Wi‑Fi
I don’t assume every portal is evil.
Here are the signs that make me pause.
The Network Name Is “Close Enough” to Be Dangerous
If there are multiple similar SSIDs, I slow down. In hotels, I also ask the front desk to confirm the exact network name and whether there’s a password.
If the staff member says, “It’s the one with a lock icon,” but I only see open networks, that’s a clue that something’s off.
The Portal Asks for a Personal Email Password
A real captive portal might ask for your name, room number, last name, or a simple access code.
A portal that asks you to log in with a Google, Microsoft, or Apple ID, or your work SSO, should set off alarms. Hotels and airports don’t need your identity provider password to give you Wi‑Fi.
Certificate Warnings and “Advanced” Buttons
If your phone or laptop throws a certificate warning when the portal loads, I treat that as a stop sign. Certificate warnings can happen for a few reasons, but on public Wi‑Fi, they’re often your only obvious clue that someone is intercepting the connection.
A Download Prompt Before You’re Online
“Install this app to connect” or “download this profile” is a hard no for me, unless I’m on a corporate-managed device and IT explicitly told me to do it.
Attackers love using the portal moment to push malware, fake VPN apps, or shady “security” tools.
The Wi‑Fi Keeps Dropping and Reconnecting
Frequent disconnects can be normal in crowded places, but it can also happen when an attacker is trying to kick devices off the real network so they reconnect to the stronger fake one.
If my device keeps bouncing, I switch to cellular or my hotspot.
My Safer Routine for Using Hotel and Airport Wi‑Fi
I’m not trying to live off-grid. I just want fewer bad surprises.
Here’s the routine I use when I have to be on public Wi‑Fi:
Turn off auto-join for public networks and “forget” the old hotel Wi‑Fi after checkout. Auto-join is convenient, and attackers count on that convenience.
Confirm the exact network name with signage or staff, not a random pop-up.
Connect, finish the portal, then start my VPN (if I’m using one). Some VPNs block the portal from loading until you authenticate.
Avoid logging into sensitive accounts if I can wait, especially banking. If I can’t wait, I use cellular.
Watch the address bar once I’m browsing. I want HTTPS, and I don’t want weird redirects.
If you want official, practical advice from a government security agency, the UK NCSC has a clear guide on using public Wi‑Fi safely.
Extra Things I Do for Family Devices and Work Laptops
Public Wi‑Fi gets riskier when you’re not the only one clicking.
For kids’ tablets and phones, I keep it simple:
I disable auto-join for unknown networks.
I tell them one rule: “If it asks for an email password, stop and call me.”
For work laptops, I assume the stakes are higher. If I’m traveling for business, I prefer a hotspot. If I must use hotel Wi‑Fi, I keep my VPN on, and I avoid accessing admin panels or sensitive systems unless I’m on a trusted connection.
What I Do If I Think I Hit a Fake Captive Portal
If I connect and something feels off, I'll do the following:
Disconnect from Wi‑Fi and turn it off for a minute.
Forget the network, so my device doesn’t rejoin.
Change any passwords I typed into that portal, starting with email accounts.
Enable multi-factor authentication if it isn’t already on.
Check for “new sign-in” alerts in your email account security page.
If you want a straightforward, consumer-friendly walkthrough on account protection and safer connections, the FTC’s security articles are a good place to start, including guidance at https://consumer.ftc.gov/topics/online-security.
Conclusion
Captive portals are normal, but captive portal attacks blend into that normal so well that people miss the warning signs. When I’m in an airport or hotel, I slow down at the exact moment most people rush, choosing the network carefully and treating portal pages like a trust test. If a portal asks for more than it should, or my device throws a certificate warning, I’m out. The goal isn’t to be paranoid; it’s to keep travel Wi‑Fi from turning into a clean-up project later.
In the ever-evolving landscape of cybersecurity, Android users face a new challenge: a surge in malicious applications. Recent findings by McAfee have unearthed a concerning trend of malware-infected Android apps, Xamalicious malware, potentially compromising the security of over 327,000 devices. This alarming revelation calls for an immediate response from Android users, especially those who have downloaded any of the identified apps from Google Play.
The Unseen Enemy: Xamalicious Malware
McAfee's discovery of the malware, dubbed Xamalicious, reveals a sophisticated attack strategy. These apps, built using Xamarin, a .NET framework, have been lurking undetected, exploiting the complexities of APK file build processes. The malware authors have skillfully combined obfuscation techniques and custom encryption to evade detection while exfiltrating data and communicating with their command-and-control servers.
The Mechanics of the Malware
Once installed, these apps attempt to gain accessibility privileges through social engineering tactics. The most concerning aspect is the potential installation of a second-stage payload. This payload can take full control of the device, functioning like spyware or a banking trojan, operating without user interaction. Additionally, some apps, like Cash Magnet, engage in ad fraud by automatically clicking ads and installing other applications, misleading users with the promise of redeemable retail gift cards
The Global Impact and Response
The scope of this Xamalicious malware outbreak is not limited geographically, with significant activities reported in the US, Brazil, Argentina, UK, Spain, and Germany. Google's response to McAfee's report was prompt, resulting in the removal of these apps from the Google Play Store. However, the risk persists for users who have already installed these apps.
A Closer Look at the Affected Apps
Here is a detailed list of the apps identified by McAfee, along with their download statistics: 1. Essential Horoscope for Android (100,000 downloads) 2. 3D Skin Editor for PE Minecraft (100,000 downloads) 3. Logo Maker Pro (100,000 downloads) 4. Auto Click Repeater (10,000 downloads) 5. Count Easy Calorie Calculator (10,000 downloads) 6. Sound Volume Extender (5,000 downloads) 7. LetterLink (1,000 downloads) 8. NUMEROLOGY: PERSONAL HOROSCOPE &NUMBER PREDICTIONS (1,000 downloads) 9. Step Keeper: Easy Pedometer (500 downloads) 10. Track Your Sleep (500 downloads) 11. Sound Volume Booster (100 downloads) 12. Astrological Navigator: Daily Horoscope & Tarot (100 downloads) 13. Universal Calculator (100 downloads)
Protecting Yourself: Steps to Take
1. Immediate Uninstallation: If you have any of these apps installed, uninstall them without delay. 2. Regular Updates: Keep your Android OS and apps updated. 3. Download Wisely: Only install apps from trusted sources. 4. Stay Informed: Regularly check for security updates and alerts. 5. Use Security Software: Install reliable antivirus software on your device.
In conclusion, the discovery of Xamalicious in Android apps serves as a stark reminder of the relentless evolution of cyber threats. Staying vigilant and informed is our best defense against these invisible adversaries. By taking proactive steps and fostering a culture of cybersecurity awareness, we can safeguard our digital lives against such insidious threats.
We all know that raising kids is a skill, but how much more complicated is it now with kids using technology so soon? Young children play on cell phones and hand-held electronics as soon as two years of age or younger. Parents are guilty of using their phones for Netflix, Disney, and whatever else may entertain their children while they, the parents, are trying to get things accomplished. We have discussed this commonality throughout numerous articles with Dale Dumbs IT Down.
With all this technology and information on the internet, how can we keep our kids safe and make sure they become cyber-smart? This is not an easy discussion, so we hope this article provides some useful ideas to help you talk to your kids and discuss the importance of cybersecurity and being cyber-smart. Much like we mentioned in How to Teach Your Kids About CyberSecurity and Games, we’ll discuss different ways to help encourage online safety and smart internet practices.
Raising Cybersmart Kids
It all starts with the conversations at home. Parents and guardians have the opportunity to provide the best knowledge and education for their children. Unfortunately, schools, daycares, etc., might not share similar philosophies for education or cyber awareness. We stress the conversations at home and encourage you to do what is best for your family. Luckily, there is a plethora of websites (like ours), programs, and games dedicated to helping families raise cyber-smart kids.
Knowledge is Power
Safer Internet Day (SID) is February 7th, 2023. This organization promotes global education and resources for a safer internet, encouraging people to participate while bringing others together to make the most of the internet's potential. Their slogan: "Together for a better internet" focuses on their mission of continually promoting safe internet practices. The European Union initially created SID in 2004, and since then, it has grown globally, working with other countries to promote cybersecurity and cyber awareness. Each year, this organization focuses on content and themes our children are experiencing such as cyber bullying, scams, predators, etc.
This global organization works within its network with a larger global resource called INHOPE, which is a European network aiming to help prevent child sexual abuse and materials. INHOPE offers hotlines to protect children from online enticement by predators. Raising our kids to be cyber smart includes identifying what online threats are like sexual enticement, predators, etc. It’s not an easy conversation; however, it’s vital to our children’s online safety. As we shared previously, there are multiple safety apps to help protect our children from unwanted content and to protect them in an emergency. However, acknowledging the threats and teaching our youth is how we can make a difference.
The National Center for Missing and Exploited Children (NCMEC) discusses the various dangers of online predators and provides resources for parents and guardians. To keep our children safe and cyber-smart, they need to be aware of all the issues out there. Online enticement and sextortion are real issues affecting our youth regularly. Online victimization is the biggest threat to our children. This is where it’s crucial to inform our children of the scary possibilities of online conversations, image sharing, information and identity sharing, and more. We discussed the benefits of Google Family Link in regards to monitoring your children’s online presence and content. Although you can monitor much of your children’s information, as we said before, their schools, friends, etc. might not be as cyber smart or as cyber aware as you’d like.
Cyber Legends is a cyber safety and educational online game for kids. The concept is that kids can learn to be cyber smart through the online game and storyline. The plot contains the evil Lord Hacker and evil robots who are causing destruction and mayhem. Station 66 needs help to fight off the evildoers. Kids can pick and choose their characters, gear, and more while exploring Station 66 and avoiding the evil Lord Hacker.
You can create an account as a parent or guardian to monitor and learn what your children learn. You can set up your kid's accounts, pick a plan, and start the journey. The cyber educational game is free but offers educators various plans annually per teacher, school, or district. The hope is that this game is introduced in elementary schools, teaching these school-age kids how to protect themselves and others against cyberbullying, stalking, and more. Game designers created various characters and activities to help keep kids cyber-aware and cyber-smart.
As we discussed before, teaching our kids to be cyber-smart can be challenging, especially when it comes to online enticement and sextortion. Cyber Legends even has a Digital Health Consent for parents and educators to learn how to approach sexual content in the digital world through various situations in Cyber Legends. Parents have a dashboard where they can see these or any other lectures beforehand.
Cyber Legends provides a safe space for kids and families to learn about being cyber smart and cybersecurity without the added stress. This platform can help back the conversations you’re having at home, bringing attention to the “forever” system the world wide web created while keeping the atmosphere friendly. Use Cyber Legends as another way to provide a defensive educational opportunity to your children so they can understand the repercussions of technology.
We know that being a parent has many challenges, and we have a lot on our plates. However, it’s up to us to stay in the know about the issues the internet, apps, and games might have. Raising your kids to be cyber smart is raising your kids as cyber aware, cyber secure, and safe from predators.
It feels like there’s a new scam or a new way for hackers to gain access to our information daily. Unfortunately, we cannot even keep up with the new ways, but we can try and inform our readers of what we hear. If you’re unsure of if someone has scammed you or is trying to scam you, there are a few ways of checking to see if you have a hacker in your phone stealing your information.
Are Hackers In Your Phone?
Believe it or not, hackers will select certain phone operating systems over others like Androids over iPhone due to an open system versus a closed system. Wanna guess which one is open? If you’re an Android user, you already are at a bigger threat level than those that use Apple products. Now Apple users, you are still on a threat level no matter your systems, as hackers do not care one way or another. It’s just whether it’s easier or not and what precautions you need to take.
Once upon a time, we avoided the internet on our devices because we were so nervous about predators and hackers. Now, we are constantly exposed to hacker attempts regardless of the internet. Almost every single app on your phone can be used to track you and your information. Even Google is guilty of tracking our information. Much like mega social media ruler, TikTok, who has been under legal scrutiny across the nation, no app is safe. There’s simple hacking from someone taking your phone and knowing the password to more advanced hacking like installing stalker software aka stalkerware.
If you’re concerned about your information, here are some of the red flags to see if a hacker is in your phone. If your battery is draining more quickly than usual, then you might have malware running in the background using your data. Most cell phone providers offer apps to show your bill and data usage. You can check to see where your data is and reassess whether you might have a hacker in your phone. Another hacker red flag is spam pop-ups when you’re using your browsers. Often, we can set our settings to block cookies or pop-ups, but if you have a hacker using malware in your phone, you might have more issues. Make sure you know exactly what sites you’re visiting and double-check your security settings. If your phone keeps shutting down, is working slowly, or doing strange things, it’s probably a hacker. Updates often provide us phone users with faster interfaces, so if your phone is still struggling, then you need to check if you have malware or a virus.
We’ve established the signs a hacker might be in your phone, so now let’s talk about how you can remove them. One of the easiest ways to remove a hacker from your phone is to change all your passwords on your accounts and social media apps. Changing passwords can greatly reduce the chances of hackers stealing your information. If you’re interested in stellar passwords, check out our Best Tips For Making Passwords Strong And More Secure for the best information.
After you’ve changed your passwords, you’ll want to make sure all those accounts like Gmail, Facebook, Instagram, and others all have the Two-Factor Authentication system. As a refresher, setting your 2FA up means that when you log into one of your accounts, there is a secondary method to verify that you are the right person logging into the account. You can set this up with your email, your phone number as a call or text, and even a special code per account. If you need to learn how to set up your two-factor authentication on your social media accounts, read up on Setting Up 2FA or What Is Two Factor Authentication.
Delete any questionable apps or downloads on your phone. If you're not sure what something is, or you don’t use it frequently, consider removing it from your cell phone. Often, users need to go into their settings and phone system to see files or to see all their downloads. Hackers can sneak malware into everything from PDF files to images and more. If you’re not using it, then it doesn’t need to exist. This will also free up space on your phone, helping the operating system run more smoothly. If it doesn’t? Then you have a hacker in your phone.
Besides keeping the above tips in check, you’ll want to start some good digital habits. For example, make sure you’re not using unsecured wifi or open hotspots when using your phone. The same rule applies to your Bluetooth, as hackers can connect to your phone using wifi, hotspots, and your Bluetooth connections. If you’re out and about, needing to charge your phone, you need to be careful about using charging stations or charging cords. These are often unmonitored and very tempting to hackers. The next time you’re at the airport, it might be smarter to just go buy a new charger at that little convenience store on the corner of the terminal.
If you’re on your home network, then we recommend firewalls and security systems. Much like you’d want to protect your family with locks on the doors or a security system for intruders, you’ll want to secure your family's personal and private digital information. Check out our suggestion for Monitoring Your Home Network and learn more about protecting your digital footprint. We also suggest getting a VPN router to keep your home network and information secure, preventing hackers from stealing your info. Learn about the Best VPN Routers.
Maintaining a safe and secure digital life is challenging. Hackers are determined to get into your phone and other devices, steal your information, and cause chaos. Use these tips to find, remove, and prevent hackers from scamming your and your loved ones.
If you’re into social media, have a social media account, or even if you have an email then you’ll want to know how to protect your account. Setting up two-factor authentication is the best way to keep your accounts safe. In other words, a 2FA prevents hackers from stealing your information and identity.
What Is Two-Factor Authentication?
If you remember from our previous article on two-factor authentication, there are a few ways 2FAs work. Most 2FAs have the option of your password and either a phone number backup or email backup in which your social media account will then verify your login via one of the mentioned backups. This is probably the most common way many users get back into their accounts when they forget their password or when they need to log in. You can receive a phone call or a text message with a security code if you chose to have your phone number as your second verification. If you choose your email as your 2FA, then the social media system will send you an email with a code or link to input. You can also choose to use a biometric established on your phone already (face recognition or fingerprint). These are security measures uniquely to you.
Facebook 2FA
If you have a Facebook account, setting up your two-factor authentication is pretty easy. For any mobile device, the pathway to setting up your 2FA is the easy. You select your Facebook profile and the next screen shows the menu below.
Select Settings & Privacy
A menu drops down for Settings
This screen will show your Profile, Account, Security, Ads, and Legal and Policies
Select Security which takes you to Security and Login.
You’ll see the Two-Factor Authentication
Next, will be the edit option which will prompt you to put in your current password and lead you to your 2FA settings.
This page allows you to see if your 2FA is on, as well as what security methods you’ve selected. You can select a backup method as well, from security recovery codes and security keys.
If you’re on a desktop computer or laptop, here are the steps to setting up your 2FA.
Go to your profile picture or hover over it on the right side of your screen. It will drop down a menu with Settings and Privacy. Selecting this option will add another menu where you can select Settings. This option will then load a new page for all settings and privacy information. On the left-hand side, you will see the option for Security and Login, which is the menu you’ll want to select for setting up your two-factor authentication.
On the Security and Login page you’ll see sections for Recommended, Where You’re Logged in, Login, Two-Factor Authentication, Setting Up Extra Security, and Advanced setting options.
In the Two-Factor Authentication, you’ll see an edit option. This option will prompt you to put in your current password and lead you to your 2FA settings.
This page allows you to see if your 2FA is on, as well as what security methods you’ve selected. You can select a backup method as well, from security recovery codes and security keys.
Whatever method you choose for your 2FA will heighten your account’s security and prevent your account from getting hacked.
Instagram 2FA
Instagram and Facebook are similar platforms for security and two-factor authentication because they are owned jointly through Meta (AKA Mark Zuckerberg). Since they are both under the same company, you can use each account as another verification method for logging in.
For mobile devices, you’ll select the three lines associated with your profile account either in the upper right corner or in the bottom left.
The menu will pop up with another menu–select Settings
From there you’ll want to select Security
Next, you will select Two-factor Authentication
You can select login codes, an authentication app, WhatsApp, and text messages, as well as an option for additional methods and trusted devices.
If your two-factor authentication is on, Instagram will let you know as you enter that setting.
For home computers, your menu option will appear on the left side of the screen. It’s been a minute since I’ve even logged in on my laptop, so I was surprised at the display changes.
Lower left, select Menu which pops up a mini window
Then select Settings, which opens your Profile tab on the right
Find Privacy and Security
Scroll down to Two-factor Authentication
Instagram and Facebook both allow users to purchase on their apps. You can create and purchase advertising from Meta, for your personal and business use. Other businesses and merchandise shops can suggest products for users, and you can buy directly from these apps. That being said, you can add a credit or debit card to your account for these purchases. Tempting as that may be, it does come with the risk of someone hacking your account and using your credit cards. Setting up your 2FA helps reduce this risk, as you’ll know where you’re logged in and on what accounts. However, we also discuss Why You Need Notifications For All Your Credit Card Transactions, so if you need more reasons–be sure to check that out.
TikTok 2FA
TikTok is another major social media outlet, and if you or your children are using this app, at the very least, set up the two-factor authentication setting. For your mobile devices, you’ll want to go to your profile and find the three lines for the menu option, probably in the upper right corner.
Select the Menu, which pulls up a mini window
Select the Settings and Privacy option
In the Account section, select the Security option
2-step Verification is the last menu option
Here you can select from a text message, email, or password in which you will add your phone number, email, or input a password.
If you selected the phone number or email, TikTok will send you a special code to verify your account choices.
For desktop/laptop logins, you’ll hover over your profile in the right-hand corner, in which a menu will pop up.
Select Settings, which opens up an account screen
I’ll be completely honest–Privacy and Settings open but yields no way for me to even find a 2FA.
This company has failed to adequately create a user-friendly desktop site and has failed in aiding in the privacy and well-being of its users. (TikTok isn’t Protecting your kids)
We’ll be honest, social media has pros and cons, and as a family, you get to choose what is best for you and your children. When it comes to the security of your accounts, having a two-factor authentication can help avoid hackers and spamming. You and your children’s safety is always at risk when getting on the internet. Use this as a guide to set up 2FAs on the most common social media sites like Facebook, Instagram, and TikTok.
If you’re looking to monitor your children’s usage of any of these apps, make sure you check out our review of Google’s Family Link as a suggestion. You’ll find other features and benefits there as well.
