Il mito della sicurezza “abbastanza buona”.
Perché le minacce moderne richiedono sicurezza dell'architettura, dati sensibili di breve durata, impostazioni predefinite più sicure e strumenti per la privacy che riducano i rischi oltre le sole abitudini migliori.
For a long time, the industry told us that being careful was mostly a matter of password complexity and common sense. A long string of characters and a cautious clicking finger were supposed to be enough.
They are not. Modern attacks are automated, scalable, and patient. Your habits are not competing against one person; they are competing against infrastructure.
The answer is not paranoia. It is architecture: reduce trust, minimize data retention, and remove single points of failure by design.
1. Passwords: Outsource Entropy to the Machine
Humans are bad at generating randomness. When we try to be clever, we create patterns that password crackers are built to exploit.
Use a password manager so every account gets a unique, high-entropy password generated by software rather than memory.
The one secret you remember should be a long passphrase, and the vault should use a modern key-derivation function such as Argon2id.
2. Authentication: Origin-Bound, Not Just Two-Factor
Traditional two-factor codes help, but they can still be phished in real time. SMS is especially fragile because SIM swaps and number port-outs are routine.
FIDO2 and WebAuthn change the protocol. A passkey or hardware key proves possession of a private key for a specific website origin, so a phishing domain cannot replay it.
- Security keys and passkeys: phishing-resistant and origin-bound.
- Authenticator apps: useful, but still vulnerable to real-time phishing.
- SMS or email codes: best avoided for high-value accounts.
3. Messaging: Encryption Is Not a Checkbox
End-to-end encryption protects content, but the design details matter. Forward secrecy keeps old conversations safer if a long-term key is compromised later.
Disappearing messages reduce the amount of data left behind. Data that no longer exists cannot be scraped, subpoenaed, or leaked months later.
Encryption does not erase metadata, and it cannot help if an attacker controls your unlocked device.
4. Network Hygiene: The VPN Reality Check
A VPN is not an invisibility cloak. It shifts trust away from the local network to the VPN provider.
Use one when it solves a concrete problem: hostile Wi-Fi, censorship, or traffic shaping. Do not expect it to fix weak browser hygiene or poor authentication.
Modern protocols such as WireGuard are attractive because their design is compact, auditable, and built from well-understood cryptographic primitives.
5. Browsers: Where Most Accounts Actually Die
Many account takeovers begin with stolen session cookies, not broken cryptography. The browser is a high-risk environment full of scripts, extensions, and long-lived sessions.
Keep extensions minimal, block third-party scripts aggressively, and separate identities with profiles or containers where possible.
Phishing-resistant authentication matters here: an origin-bound hardware key refuses to participate on the wrong domain.
6. Secure Sharing: Reducing the Blast Radius
Secrets sometimes need to be shared, but email and workplace chat create permanent security debt through logs, backups, previews, and metadata.
The safer pattern is ephemeral, client-side encrypted sharing: encrypt before upload, avoid storing keys server-side, and expire aggressively.
Ephemerality is not a gimmick. It is data minimization applied to human workflows.
A Weekend Baseline
Security is not a binary state. It is incremental friction applied in the right places.
The goal is not to be unhackable. The goal is to make the cost of attacking you higher than the value of the data gained.
- Move sensitive accounts to unique, manager-generated passwords.
- Add hardware-backed authentication to your primary identity, especially email.
- Audit and remove unnecessary browser extensions.
- Move sensitive conversations to an end-to-end encrypted messenger with disappearing messages enabled.