With new AI capabilities come new risks.
I have noticed an uptick in login attempts to my online wallets, banking, and email services.
Here are some of my recommendations for reducing your risk of attack. Note, don't try to do everything all at once, as you might get overwhelmed.
Just go at a comfortable pace, implementing one strategy at a time. Use AI's to answer questions if you get stuck.
1. Use a password manager and create a different password for every site. That way, if a website is compromised (and they will all be compromised eventually), it does not compromise all of your other sites. I like Bitwarden; KeePassXC is also good.
2. Do not trust phone calls, even if they seem to be from someone you know intimately. New AI models can clone voices based on small clips (such as Facebook Reels or your voicemail greeting). Scammers can spoof phone numbers. If a loved one calls asking for money, be especially suspicious. Offer to call them back at a known good number. Set up a secret password with all of your close friends and relatives.
3. Set up two-factor authentication. I like Aegis (software) and Nitrokey (hardware).
4. Use a more secure operating system. Linux (on desktop) and GrapheneOS (on phone) are best for most people. Use AXP OS if you cannot afford a Pixel device. In my opinion, Linux Mint is a reasonable Linux desktop choice for beginners.
5. If you want to run insecure apps such as Windows or agentic AIs like OpenClaw, run them inside a virtual machine (VM) like QEMU. A VM can be sandboxed from the rest of your system. That way, if you accidentally install a rogue AI or virus, it will not be able to easily see or alter the rest of your system.
6. Use a browser with a robust ad-blocker like uBlock Origin. I like the Brave browser, which blocks many attacks out of the box. Many modern attacks occur through malicious advertisements (malvertising) or scripts that run automatically when you visit a site. A good ad-blocker stops these scripts from loading, providing a simple but effective layer of defense against drive-by downloads.
7. Enable full-disk encryption on all your devices. A secure operating system can be bypassed if an attacker has physical access to your hardware. Use LUKS on Linux or the built-in encryption on GrapheneOS to ensure that if your laptop or phone is stolen, your data remains unreadable without your passphrase.
8. Keep your software up to date. Security vulnerabilities are discovered daily, and developers release patches to fix them. Enable automatic updates for your operating system and your browser. This ensures you are protected against the latest known exploits without having to manually check for updates every day.
9. Maintain an offline backup of your most important data. If you are hit by ransomware or a hardware failure, having a copy of your files on an external drive that is not constantly plugged into your computer is a lifesaver. Follow the 3-2-1 rule: three copies of your data, on two different types of media, with one copy kept at a different location.
10 Use an email aliasing service. Instead of giving your real email address to every website, use a service like SimpleLogin or Firefox Relay to create a unique alias for each account. This stops trackers from linking your accounts together and keeps your primary inbox clean if one of those services starts sending spam or gets breached.
11. Follow privacy/security professionals on Twitter to stay abreast of the latest news. I like Naomi Brockwell (@naomibrockwell), Sam Bent (@DoingFedTime), and Gabriel Custodiet (@WatchmanPrivacy).
Bibliography
[1] Bitwarden, Bitwarden Courses - Personal, Bitwarden, 2026. This official training series provides a comprehensive walkthrough for beginners to set up an account, install browser extensions, and master the auto-fill features. https://bitwarden.com/help/courses/password-manager-personal/
[2] YouTube, How to Use KeePassXC - Full Beginner Tutorial (2026), YouTube, 2026. A step-by-step video guide for those preferring local-first password management, covering database creation and secure entry organization. https://www.youtube.com/watch?v=HjIc2bERZFk
[3] Fidelity Bank, How to protect yourself from AI voice scams, Fidelity Bank, 2025. This guide outlines practical social engineering defenses, such as establishing "safe words" and verifying identities through callback procedures to thwart AI cloning. https://www.fidelity-bank.com/news/watch-out-for-ai-voice-scams
[4] Nitrokey, Getting Started - Nitrokey Documentation, Nitrokey, 2026. This technical documentation provides the necessary steps to initialize hardware security keys for FIDO2 and U2F authentication on various web services. https://docs.nitrokey.com/nitrokeys/nitrokey3/getting-started
[5] GrapheneOS, Web installer | Install - GrapheneOS, GrapheneOS Foundation, 2026. The official, most user-friendly guide for installing GrapheneOS via a browser, ensuring a secure and verified boot process for mobile devices. https://grapheneos.org/install/web
[6] Ubuntu, QEMU - Ubuntu Server documentation, Canonical, 2026. A detailed tutorial on installing and configuring QEMU/KVM to run virtual machines, emphasizing hardware acceleration and basic sandboxing. https://ubuntu.com/server/docs/how-to/virtualisation/qemu/
[7] QEMU Project, Security - QEMU documentation, QEMU, 2026. This documentation explains the security model of QEMU, including how to isolate guest systems from the host to prevent malware from escaping the virtual environment. https://qemu-project.gitlab.io/qemu/system/security.html
[8] uBlock Origin, uBlock Origin Documentation, GitHub, 2026. A guide to the most effective wide-spectrum content blocker, explaining how it protects users from malicious scripts and advertisements. https://github.com/gorhill/uBlock#ublock-origin
[9] SimpleLogin, How to use SimpleLogin, SimpleLogin, 2026. An introduction to email aliasing, showing how to create and manage unique identities to protect your primary email address from data breaches and spam. https://simplelogin.io/docs/
[10] World Backup Day, World Backup Day Guide, World Backup Day, 2026. A resource explaining the importance of the 3-2-1 backup strategy and how individuals can start securing their digital memories and documents. https://www.worldbackupday.com/
![With new AI capabilities come new risks.
I have noticed an uptick in login attempts to my online wallets, banking, and email services.
Here are some of my recommendations for reducing your risk of attack. Note, don't try to do everything all at once, as you might get overwhelmed.
Just go at a comfortable pace, implementing one strategy at a time. Use AI's to answer questions if you get stuck.
1. Use a password manager and create a different password for every site. That way, if a website is compromised (and they will all be compromised eventually), it does not compromise all of your other sites. I like Bitwarden; KeePassXC is also good.
2. Do not trust phone calls, even if they seem to be from someone you know intimately. New AI models can clone voices based on small clips (such as Facebook Reels or your voicemail greeting). Scammers can spoof phone numbers. If a loved one calls asking for money, be especially suspicious. Offer to call them back at a known good number. Set up a secret password with all of your close friends and relatives.
3. Set up two-factor authentication. I like Aegis (software) and Nitrokey (hardware).
4. Use a more secure operating system. Linux (on desktop) and GrapheneOS (on phone) are best for most people. Use AXP OS if you cannot afford a Pixel device. In my opinion, Linux Mint is a reasonable Linux desktop choice for beginners.
5. If you want to run insecure apps such as Windows or agentic AIs like OpenClaw, run them inside a virtual machine (VM) like QEMU. A VM can be sandboxed from the rest of your system. That way, if you accidentally install a rogue AI or virus, it will not be able to easily see or alter the rest of your system.
6. Use a browser with a robust ad-blocker like uBlock Origin. I like the Brave browser, which blocks many attacks out of the box. Many modern attacks occur through malicious advertisements (malvertising) or scripts that run automatically when you visit a site. A good ad-blocker stops these scripts from loading, providing a simple but effective layer of defense against drive-by downloads.
7. Enable full-disk encryption on all your devices. A secure operating system can be bypassed if an attacker has physical access to your hardware. Use LUKS on Linux or the built-in encryption on GrapheneOS to ensure that if your laptop or phone is stolen, your data remains unreadable without your passphrase.
8. Keep your software up to date. Security vulnerabilities are discovered daily, and developers release patches to fix them. Enable automatic updates for your operating system and your browser. This ensures you are protected against the latest known exploits without having to manually check for updates every day.
9. Maintain an offline backup of your most important data. If you are hit by ransomware or a hardware failure, having a copy of your files on an external drive that is not constantly plugged into your computer is a lifesaver. Follow the 3-2-1 rule: three copies of your data, on two different types of media, with one copy kept at a different location.
10 Use an email aliasing service. Instead of giving your real email address to every website, use a service like SimpleLogin or Firefox Relay to create a unique alias for each account. This stops trackers from linking your accounts together and keeps your primary inbox clean if one of those services starts sending spam or gets breached.
11. Follow privacy/security professionals on Twitter to stay abreast of the latest news. I like Naomi Brockwell (@naomibrockwell), Sam Bent (@DoingFedTime), and Gabriel Custodiet (@WatchmanPrivacy).
Bibliography
[1] Bitwarden, Bitwarden Courses - Personal, Bitwarden, 2026. This official training series provides a comprehensive walkthrough for beginners to set up an account, install browser extensions, and master the auto-fill features. https://bitwarden.com/help/courses/password-manager-personal/
[2] YouTube, How to Use KeePassXC - Full Beginner Tutorial (2026), YouTube, 2026. A step-by-step video guide for those preferring local-first password management, covering database creation and secure entry organization. https://www.youtube.com/watch?v=HjIc2bERZFk
[3] Fidelity Bank, How to protect yourself from AI voice scams, Fidelity Bank, 2025. This guide outlines practical social engineering defenses, such as establishing](2026-03-10-fb-004-img01.webp)