Standard Online Safety Guidelines

Beyond being aware of scams and using antivirus software, there are many things you can do to help keep you safe online. If you’re not familiar with antivirus software or common online scams, I’d suggest reading up on those topics as well.

In this guide, I will discuss standard practices you should use to stay safe on the web.

Only Browse Reputable Sites

Understanding which sites are reputable can be tricky!

Thankfully, modern browsers, search engines, and email clients do their best to warn you before you visit a risky website. However, there are some places you should probably avoid visiting.

Misinformation

Websites like InfoWars, NewsPunch, and WorldNetDaily all profit by spreading lies or misinformation. They cater to conspiracy theorists, fringe political groups, racists, history deniers, and more.

InfoWars is a commonly cited example. On its surface, it appears like a reputable news website. At a glance, it could easily be mistaken for something like the New York Times. However, its articles serve a much more nefarious purpose. They’re designed to confuse the public, cast doubt on valid, proven election processes, and unrealistically reframe historical events. Their end goal is to raise money for their owners with no regard for who gets hurt by the misinformation. They just want to reel you in, keep you coming back, and buy their scams.

But how can you tell if something is nonsense?

It may tempt you to believe the stories you read on a misinformation website. They’re carefully crafted to appeal to their audiences! However, I’d encourage you to do your research first when evaluating any news source, regardless of where you fall on the political spectrum.

Specifically, if you’re more conservative leaning, check out sites like Reason Magazine or TheAmericanConservative. These websites cater to a conservative audience, without spreading false information about vaccines, school shootings, and other conspiracies.

If you’re unsure of how factual a website is, you can visit https://mediabiasfactcheck.com to see their political leaning and how factual they are.

You may visit https://www.allsides.com to see how biased certain outlets are in different directions. Looking for a mostly neutral outlet? Check out Reuters, The BBC, or the Wall Street Journal. If you’re left leaning, CNN, The Washington Post, USA Today, and NPR all provide excellent fact-based coverage.

It’s okay to read biased media that serves your interests, however, do your due diligence and ensure you’re not being taken for a fool by the likes of Info Wars and Alex Jones.

Misinformation websites serve ads for disreputable products. Valid professional organizations won’t do business with them. Look out for sites that advertise click-bait get-rich-quick schemes, instant weight loss pills, or other snake oil. You can tell a lot from a website just based on who’s willing to advertise there!

In the sample advertisement taken from InfoWars, they’re pushing dietary supplements called “DNA FORCE PLUS.” Please, don’t put this in your body…

Identifying Disreputable Websites

Here are some key questions to ask whenever you visit a new site on the internet, to help determine how reputable it is.

• Is the site up to date?
  • Has the page been updated recently? Does the website look and function as you’d expect a typical modern website to? If not, proceed with caution.
• Is the information in posts and advertisements true?
  • When in any doubt, consider looking at https://mediabiasfactcheck.com and https://www.factcheck.org – These organizations employ many fact checkers responsible for verifying stories with actual credible facts.
  • If it sounds too good to be true, it is.
    • Examples: “Lose 10lbs in a week doing nothing!” “This simple vitamin stops Covid in its tracks!” “Rapidly double your income with this simple program.”
• Avoid overly sensationalized, generalized, highly unlikely, or marginalizing articles and advertisements. Most news outlets have a few sensational stories. However, if every story is like that, it’s a red flag.
  • Examples
    • “Obama SCREAMS at audience looking for votes.”
    • “Illegals throwing the election!”
    • “Covid vaccine KILLS pregnant mother.”
    • “Fox news host is SHOCKED…”
    • “Republicans are attacking the heart of our democracy!”
• Is the organization reputable?
  • Can you find out who the owners or organizers are? Are they respected in their fields? Do they have the authority to speak on the subject?
  • If the website serves illegal purposes (software piracy, etc), it’s automatically disreputable.
• Are the authors reputable?
  • Does the content make sense, or is it contradicting known scientific facts? Was the article written by Joe Schmoe, or by a PhD researcher who’s an expert in their field? Does the author have a good reputation in their field? Is the author only writing to serve their self interests or sell you something sketchy?

Consider installing the Media Bias/Fact Check browser extension, which flashes warnings if you visit a site containing conspiracies, false information, or fringe left/right content.

Avoid News from Social Media

Social media is a great, easy-to-use way to connect to people with similar interests. However, you can find yourself in a negative feedback loop of misinformation if you join the wrong groups.

Do not rely solely on social media for your news. Read the relevant articles from several reputable sources when possible.

• Social media groups gone awry
  • Pro Eating Disorders (Pro-ED, Pro-ana, Pro-anorexia) groups have been identified on Facebook, Reddit, and other platforms.
    • These groups encourage their users to stop eating, exercise constantly, and of course, lose weight.
  • r/cripplingalcoholism – A subreddit for alcoholics content with being alcoholics
  • Parenting groups are notorious for being judgemental and giving incorrect advice
  • Fake science, incorrect information on vaccines, etc.

Red Flags 

If you notice any of the following, the site you’re on almost certainly isn’t reputable.

Unsecured Connection 

If the site’s address begins with “http” instead of “https” or your browser explicitly says “Not Secure,” then you do not have a secure connection to the site you’re visiting. This means your network traffic is not encrypted. Do NOT enter any sensitive information, passwords, etc. into unsecure websites.

Overtly Asking For Sensitive Information

If a website asks you for information that it clearly doesn’t need, don’t give it to them. Things like SSNs and addresses should only be shared online under the right circumstances. It may be OK to provide that information to a doctor’s office, a banking website, or TurboTax, but it’s not okay to disclose it to anyone who asks.

Many Typos in Content or Address

Typosquatting is the practice of intentionally misspelling domain names for nefarious purposes. For example, someone might reserve the address “traMsunion.com” instead of “TransUnion.com” and attempt to steal your credit information. Always check that the address is spelled correctly and the site you’re on is actually the right website.

If the content itself is riddled with typos, this could be a sign that you’re not on a professionally built or official website. It may mean that the author’s just a poor writer, or speaks English as a second language. However, don’t disclose any personal information on websites containing many typos. It’s probably not safe.

Pretending To Be Official

Have you ever received a notice in the mail that looks like it’s from the government, but really they’re just trying to get you to buy something? Websites and emails can do that too.

Don’t trust any communications regarding legality, fines, etc. unless they come directly from a government agency, usually through the physical mail. Official government websites end with the .gov domain extension.

Basic Information Security

There are many tips and tools we can use to keep our information safe online. Here are some of the easiest ones to implement.

Password Manager

Remembering passwords is difficult. It may tempt you to use the same password, or a small group of similar passwords, across every account you use online. While reusing passwords is convenient, it quickly becomes a big problem if one password gets compromised.

Unfortunately, security breaches are not uncommon. Companies of all sizes have lost sensitive user information, including passwords, because of hacking, exploits, disgruntled employees, government sponsored attacks, or even just by accident. This year alone, Plex.tv, Crypto.com, Uber, and Medibank have all been compromised in some manner.

To prevent one security breach from affecting all your accounts, the best line of defense is to use a unique password for every single account. To keep track of all these passwords, you’ll want a password manager.

Password managers are software services which generate and save passwords for you, usually in a secure, encrypted online vault. You create a single master password, set up two-step verification (phone message code, email, authenticator app, etc.), and now you can access all your passwords on any of your devices. They try to be as easy to use as possible and have apps to integrate with your phone, tablets, and web browsers. Now, you only have to remember one master password rather than a hundred random passwords.

Whenever you need to login to a website or app, you just use the password manager. They add biometric security (FaceID, fingerprints, etc.) as an added layer of protection. Just visit the website, use the fingerprint scanner (or whatever), and you’re in.

If you’re using Mac and iPhone, you can use Apple’s built-in password manager. It should automatically prompt you to generate and save passwords as you enter them. These passwords are tied to your Apple ID. If you lose your phone, you can just sign in on a new device and retrieve all the passwords, provided you remember the Apple ID password, of course.

The same applies to Android. If you’re using Google Chrome and Android, you may use Google’s password manager.

Microsoft offers password management with their Edge browser and Microsoft Authenticator App, available for iOS and Android.

Finally, if you’re looking for a third-party solution that works great across all different devices, I’d suggest BitWarden. 

Not only do password managers make your accounts more secure, they make logging in anywhere super convenient!

Checking Compromised Accounts

Several tools can check if your accounts have been hacked. First, watch out for communication from the website itself. Reputable sites will inform you if their systems have been compromised and you need to reset your password.

Beyond that, you can manually check if your account’s been compromised by entering your email and/or phone number at https://haveibeenpwned.com

The “Have I Been Pwned” site checks your information against a database of know security breaches and informs you of each one. It tells you the company, date, and type of breach. If you’ve since reset your passwords from an account that was “pwned” several years ago, you probably don’t have to do anything.

Password managers like the one in Google Chrome have built-in password checkups, which run similar checks. If you use BitWarden, you can use the “Exposed Passwords” tool on their website when you’re logged into your account, under the “Tools” menu option.

Use Two Factor Authentication (2FA)

Two factor authentication adds an extra layer of security to your accounts. Use two factor authentication (2FA) with your important apps and websites. It’s usually required for important accounts, such as those related to your finances, however many other accounts, like Google, Facebook, and even some video games, support 2FA optionally.

2FA means an additional method is used in combination with a password to verify your identity and log in. The most common is a text message containing a verification code. With 2FA enabled on an account, even if someone gains your password and tries to log in, they can’t access your account, since they don’t have your 2FA device.

More secure options can include dedicated authenticator apps such as Google Authenticator or Microsoft Authenticator. These apps display time-sensitive codes that change every thirty seconds. The only way to log in to an app protected with this type of 2FA is to have your password and your device with the right authentication code.

Finally, some apps support physical authentication keys, such as YubiKey. These devices plug into your computer or use NFC to verify your identity. They contain a unique key that cannot be replicated. With these set up, no one can get into your account without the physical key in hand.

Careful Disclosing Personal Information

Unless you are on an official government website (the website name should end with .gov if you’re in the USA), or perhaps a trusted financial institution’s website, you should not have to give out sensitive information. At most, a website might ask you for your name and email or an address if you’re trying to buy something from them.

If you are concerned about the safety of your information on a new website, you can always register using a secondary email address and a fake name, provided you’re not buying things from them.

• Never enter your bank account details, social security number, or state ID number into any forms, unless it’s on an official government website, trusted medical website, or trusted financial institution. Check the address and ensure it’s the right site, not a copycat.
• Never provide your full billing address, unless you’re actively purchasing something.
• Be careful when shopping online. Shop from trusted stores you’re familiar with.

Careful With Online Payments

When making online payments, there are several steps you can take to protect yourself.

1. Only shop from reputable stores you trust with your information (Amazon, eBay, Walmart, BestBuy, Target, Home Depot, Lowes, Macys, to name a few)
2. If shopping on an unfamiliar website, pay with a trusted third-party payment processor, such as PayPal, Venmo, or Apple Pay when possible.
3. Always pay with a credit card. Avoid paying with debit cards.
   • The rationale behind this is that credit card processing companies typically offer built-in fraud protection and will quickly reverse any suspicious transactions if you ask.
   • Your bank should offer protection if you use a debit card, too. However, since it’s coming directly out of your bank account as a DEBIT, it may be harder to get funds returned.
4. Never pay with a bank payment or account number/ACH, unless you really trust the website

Virtual Credit Cards

Some credit cards and banks now offer virtual credit cards or one time use cards. These systems generate a credit card number with a limit you set, to protect you from unauthorized or unexpected charges.

One website offering this service is Privacy.com which has both free and premium options. Link your bank account to the service. Then, when you want to buy something online from a new website, create a new virtual card and use that info to pay.

It’s also useful if you want to sign up for a trial, but don’t want to risk being automatically charged for it later!

Note that some companies have ways of detecting if these virtual or one time card numbers are being used. If that’s the case, you may have to use your real credit card information.

For sites you trust and regularly use, it may make sense to continue using your real credit card number for the sake of simplicity.

Piracy 

One of the easiest ways to let an unwanted party into your computer is by downloading pirated software, media, or eBooks. I understand that not everyone can afford to purchase games or buy movies. However, if you decide to go the piracy route, you are opening yourself up to several potential problems.

Piracy sites shouldn’t be trusted. Anyone can upload torrents. Some people who upload deactivated software or “cracks” online include trojans or other viruses with their uploads. Sure, you might get the latest $60 games for free, but it’s probably not worth it if it ends up compromising all your passwords and your computer crashes.

The most secure place to download any piece of software you’re running on your PC is directly through the software publisher or a curated app store such as the Android/Apple App stores, Microsoft Store, Steam, Amazon app store, etc. Companies like Microsoft and Adobe will not include viruses with their official installers. This isn’t necessarily the case for pirated versions of their software, which may easily be infected.

Piracy websites aren’t reputable to begin with. They facilitate illegal activity, after all. Most websites can offer free content through the use of advertisements. However, no reputable company is going to pay to have their ads displayed on a piracy website. So the ads you see on these websites are also likely coming from less than respectable organizations. If you visit these advertised sites, you risk running down a rabbit-hole of misinformation and scams.

Finally, if you pirate content online, you risk your internet service provider, the government, or the copyright owner finding out. If this happens, usually you’ll get a warning from your internet provider. After several warnings, they may end your service, leaving you without your first choice internet provider. In the worst-case scenario, you can be sued or taken to court by the copyright holder.

Alternatives to Piracy

Here are some commonly pirated items, and ways to get similar experiences for free or low-cost.

• Music
  • The music piracy scene isn’t as big as it used to be. If you’re looking for free alternatives to music piracy, check out Spotify’s free tier and Pandora. You can also watch music videos on YouTube for free.
  • If you’re an Amazon Prime member, you can listen to millions of songs with their included Amazon Prime Music.
  • If you want to listen to virtually anything, consider subscribing to a paid service like Spotify, Tidal, YouTube Premium, or Deezer. They start at roughly $10/month, and it can be even cheaper if you can share it with your family or friends. Student discounts may be available, too.
• Movies & TV
  • Consider free ad-supported streaming services like Plex.tv or TubiTv.
  • Avoid sketchy free streaming sites that promise live sports, in-theatre movies, licensed tv shows, etc. for free. These are not reputable websites.
  • If you’re an Amazon Prime member, you get access to thousands of movies and tv shows with no advertisements through your membership.
  • Buy a subscription to a streaming service like Netflix or Hulu, from $8/month.
  • Ask a friend or family member if they can share streaming logins with you.
  • Go retro and buy a digital TV antenna for your TV or computer. You may get several local channels for free.
• Video Games
  • Consider looking at the thousands of free-to-play games available. Fortnite, Overwatch 2, CS Go, Rocket League, World of Warships, 0 AD, and Fall Guys are some examples of great free to play games that will keep you occupied for hours.
  • Buy a subscription to a service like Microsoft’s Gamepass ($10 or $15/month) to get unlimited access to hundreds of premium games. PlayStation plus offers this too.
  • The Epic Games store includes one or two freebies each week. They’re usually $10-$30 games. If you claim them each week, you’ll eventually have a nice collection of premium games for free.
• Software
  • There are thousands of excellent free or open-source software titles available online. Here are a few:
    • Microsoft Office Alternatives – MS Office Online through OneDrive.com has free browser-based versions of their productivity suite. Google Docs is free to use as well and is a great alternative.
      • LibreOffice is the best open source MS Office clone.
      • Dia is a good flow chart / UML diagram tool
    • Adobe Alternatives
      • Want Photoshop? – Try Gimp or Krita
      • Want Illustrator?  – Try InkScape
      • Want Premiere? – Try Shortcut or OpenShot
      • Adobe CC is available to students for $30/month, still kind of expensive, but about half the price of their regular offer.
      • If you only need a single Adobe app, like just Photoshop, for example, you can get it for as low as $20/month without a student discount.
    • 3D Modeling Alternatives (Autodesk, Cinema4D, etc) – Try Blender
      • Autodesk also offers completely free versions of their programs for students. Maxon (Cinema4D) has heavily discounted versions for students.

Wrap Up

To conclude, there are many things you can do to stay safe online beyond just installing Antivirus! Play an active role in your safety by visiting safe websites and avoiding disinformation. Use the tools discussed to help.

• Check your sources – avoid misinformation and extremely biased content
• Avoid social networks as your primary source of news
• Don’t pirate software, media, or video games
• Only disclose personal information on trusted sites
• Pay with credit cards rather than debit cards
• Never share banking details with unfamiliar websites
• Use a Password Manager
• Use two factor authentication, where applicable
• Use an antivirus application
• Keep your operating system and software up to date

Tools Recap

• Password Manager
  • Use your favorite web browser’s built in password manager OR check out BitWarden
• Two Factor Authenticator
  • Android: Use Microsoft or Google’s authenticator app (I prefer Microsoft’s)
  • Apple: Use Microsoft or Google’s authenticator app (still prefer Microsoft)
• Fact & Media Bias Checker
  • Visit mediabiasfactcheck.com
  • Install the Chrome/Edge Extension

Further Reading