Keep a passcode enabled on your phone. Seriously.
If you don't have a passcode on your phone, you're making your data easily accessible to anyone who comes across your phone if it's lost or stolen.
A four-digit PIN has 10,000 possible combinations, which is fairly secure, but a six-digit code has 1 million possible combinations.
Apple's Touch ID sensor or a fingerprint sensor on a modern Android phone is also a great way to secure your device.
Turn two-step verification on for every online account you have that supports it, especially your email provider.
Two-step verification is an additional security process that requires you to authenticate yourself on another device, typically your phone. It's meant to prevent someone from logging into an account with just your email and password, and it's very effective at keeping your accounts safe.
Your email provider is a particularly important login that should have two-step enabled; if hackers gain access to your email, then they may be able to access other accounts that your email is registered with — just ask Jennifer Lawrence.
Most major companies that host sensitive data offer two-step verification for online accounts, including Apple, Google, Microsoft, Amazon, Dropbox, and Facebook.
Use different passwords for your logins. 1Password is a great app to manage them.
It's bad practice to use the same process across different logins, especially ones that have access to sensitive information like banking credentials.
You should be using a different password for every login you have. Unless you have an impressive memory, you'll probably want to use a password manager to help you keep track. 1Password is the best app for the job.
Apple's iMessage is encrypted, but if you're still nervous or want something that works on iOS and Android, use the Signal app.
Apple's iMessage is end-to-end encrypted, which means it's safe for 99% of communication. The company has testified repeatedly in court that if the government were to subpoena a customer's iMessages, Apple wouldn't be able to comply because it's encrypted data.
"Encryption is a byproduct because Apple could do it to make it safe," Will Strafach told TI. "I don't think it's meant to be a private secured thing as a primary goal."
Strafach also recommends Signal as a good encrypted chat app. It's open-source, which means it's not controlled by any one company and it's encryption methods are available for anyone to examine.
But only use something like Signal if you're seriously concerned about being spied on.
"Unless you have a reason to be surveilled, you're probably not going to have to worry a lot about this," Strafach cautioned.
FaceTime and Signal will both let you make encrypted audio calls.
If you're worried about the feds listening in on your calls, both Signal and FaceTime encrypt audio calls over an internet connection.
A VPN doesn't necessarily mean that all your web traffic is in safe hands, so exercise caution.
A common security practice for when you're connected to a public WiFi network is to use a VPN, or virtual private network. This encrypts all of your traffic, making it impossible for a hacker to see what data you're transmitting over the WiFi network.
But VPNs also introduce a potential problem: the provider offering the service.
"You have to trust the VPN provider with no way to know if they're not keeping logs," explained Strafach. "They can say in the marketing that they're not keeping logs, but you don't know if they're actually keeping them or not."
Most of your apps should encrypt their web traffic already, but if you're worried about using an open WiFi network, you can try a VPN provider like TorGuard or Cloak.
If a link or email looks suspicious, don't open it.
It may sound obvious, but your common sense is the best defense against you getting hacked.
If a website or email looks fishy, then don't engage. Never give a website sensitive information unless you know it's authentic. The little padlock in the top of your browser next to the URL is a good indication that it's legit.
