Here is an EASY guide for you to stay safe online no matter where you are at: we discuss TOR, VPNs, password managers, 2FA and hardware devices.

During the first week of a long-planned and saved for South America journey, our friend became affected by cyber crime and was left with almost no means for the remaining 6 months of her trip. Her mistake was using unsecured public WiFi in a Starbucks in Lima to book bus tickets. Her credit card details were stolen and most of the money on the card was gone.

Online related crime and identity theft are on the rise with apparently 23% of US citizens having been victimized in 2018. With an estimated 1.5 trillion USD profit made by cybercriminals.

As a traveller, I often use online banking as well as other services that required a secure connection in places such as coffee shops, hostels and the occasional public unencrypted WiFi you can find at airports and several cities across the globe.

But maybe, more importantly, I've been a cyber security advisor for a long time so that I know a thing or two about cyber security. Bypassing "security" and getting onto password-protected WiFis really isn't all that difficult in many cases. And even if the network is actually secure from a technical perspective you cannot always trust it's operator - much the same as another experience that a lot of people can relate to that had their credit card identity copied in some country (This statistic claims a total of 16.7 million US citizens became victims in 2017).

Here we will discuss some of the things that I believe everyone can easily do to up their cyber security and stay safe online.

#1 Use The Brave Browser
The easiest option, which also doesn't cost you anything - unlike your typical VPNs (Virtual Private Networks) is to use the Brave browser.

First of all, it will always try to upgrade your connection to a secure one, so that nobody else on the WiFi or network can read your username and passwords. (On passwordless WiFi anyone with a WiFi device can also look at your network traffic floating through the air)

NOTE: Whenever you do any online banking, please make sure that the lock icon next to the address bar indicates that the connection is indeed secure (meaning encrypted)!

Even better though is the fact that Brave has a special private mode that can protect you from advanced cyber crime.

How to use Facebook in China?
And of course, if you are in a country that attempts to block certain websites (such as some have done with Facebook) you can easily bypass those restrictions using TOR.

Save money on flights
If you read our article about booking cheap flights, you will also know that airlines track users in order to increase prices once they come back - since if you look at the same flight several times they can infer that you really need that flight... another great use case for TOR in the Brave browser.

Fed up with Ads?
The Brave browser also comes with an integrated ad blocker - so there is no more need to go and find the best ad blocker whether that's ublock adguard or one of the many other ad blockers. Of course, being integrated into the browser itself, it can easily outperform the javascript-based ad blockers.

If you have not yet heard of Brave I suppose you might wonder whether Brave may be a bit quirky or if it has issues with modern web features... it is pretty much like Chrome - that's because it is a chromium-based browser - Google's open-source version of Chrome - therefore it keeps all features as well as the look and feel you know and love from Chrome. Chrome extensions will also work in Brave.

Brave is available on all platforms. Click below to download it for free.

Some more great things could be said about Brave, such as the integrated torrent program and the optional advertising that pays you for seeing ads, but that's not the focus of this articles so let's go to point two.

#2 A proper password manager such as LastPass or 1Password.

You have probably heard this many times – do not reuse your passwords to stay safe online and use one that is at least 10 characters long including symbols and numbers.

I feel your pain... passwords aren't meant for human brains and trying to remember a different password for each website that's 10 characters or more including upper-case characters, numbers and symbols is obviously not something any of us can do.

Short passwords - the ones you can remember - something about 6 characters long can be guessed in seconds by modern computers. But if you use one really complicated one across multiple sites, you run into the issue that eventually one of those sites will be compromised by hackers - and since a lot of companies engage in the very questionable practice of storing passwords in readable form (facebook leaked up to 600 million passwords) your password is suddenly out there and somebody tries to use your password on other sites such as PayPal and whatnot.

Even if you only reused your password for "not so important sites", someone might use it for identity theft - gaining access to your social media can have serious consequences if for instance someone impersonate you on Facebook, asking your family and friends for money in a really convincing way - maybe claiming you had an accident and you need to cover a medical bill - somebody might fall for it. Which in reality happens quite a lot.

The thing is that the browser integrated password managers, and even those in your operating system do not work very well in our every day lives as most of us tend to have more than one device and quite probably different devices with different operating systems.

So the best option to stay safe online is to use LastPass or 1Password and here is why: Once you are set up, your passwords will be synchronized across all your devices and browsers - this works because you have a local decryption key that is protected by one last password that you will need to remember or store securely - your passwords are then encrypted and stored inside a file on the cloud - so even if that file gets out there is no way to get your passwords from it without your master password.

All the decryption is done on the local device - so not even LastPass / 1Password has access to your passwords.

They are available for pretty much every platform out there, you can get browser extensions and install them from the AppStore / GooglePlay.

Protect yourself from identity theft now by downloading LastPass or 1Password for free below.

#3 Consider using two-factor authentication (2FA) where it is most relevant - such as for financial services.

You are probably already using this for your online banking - you'd know it as a TAN (transaction authentication number). Many other sites support this - including most social media sites and email providers - you can find a list here. Using a second factor for authentication makes it much harder for cyber criminals to get access to your accounts - as they will not only need your password but also your mobile device.

One of the most commonly used 2FA methods is the GoogleAuthenticator - which is available for free on the AppStore & GooglePlay. I will quickly outline how this works: To use GoogleAuthenticator with a website you will have to log in to that site and find out if they support 2FA. If they do, you will be presented with a QR code that you need to scan with the app on your phone. Your phone will then present you with a code that you will need to enter back on the website. That's it. You are all done. From then on every login on that site will prompt you for a code from the app. The code will change every minute based on the global time - this means that no internet or mobile service is required for the app to work. Remember that if you ever have your phone in airplane mode for a very long time, its clock may go out of sync and the 2FA might stop working. Simply reconnect to the mobile network and your phone can re-synchronize the time ;).

Click below to get Google Authenticator

#4 Use a VPN for cyber security

We have a more in-depth article about VPNs available for you here. To recoup: A VPN is a virtual private network - as the name implies you can create a secure network on top a public one that you may not trust - this also means that you hide your true whereabouts - whatever website you open will think you are at the location that your VPN server is at.

I honestly feel that VPNs receive a little too much attention - The things mentioned above will already give you great cyber security. And Brave's TOR private mode does the same job that a VPN does - no extra setup or tool required. There are however some scenarios in which you may prefer a paid VPN service:

TOR is a free network - if you plan to transmit huge amounts of data, you might find it to be too slow. Paying for a VPN is almost certainly going to get you a faster connection. There are many VPN providers... not all of them may deliver the performance that you might expect. I think I should explain here, that if you tunnel your network traffic over another network (that's what VPNs and TOR do) you are not just limited by what bandwidth your Internet Service Provider (ISP) can provide, but also by the network that forwards your connection.

Brave's private TOR window only protects the connections you open through that window. Your operating system and other programs/applications will still connect directly over the normal network. Of course, you can get the standalone tor download here that integrates into the operating system and reroutes all the traffic, but this is not quite the polished experience that VPN providers have developed which makes all of that system-level integration much simpler. I'd also argue that routing all traffic across TOR is most likely too much of a good thing for most users.

If your goal is to stream video - maybe to use NetFlix in countries that do not have access to it - you got a very good use-case for a VPN. You should, however, check if the provider you are interested in indicates that their service works for that particular service. Obviously, NetFlix tries to prevent that exact thing from happening.

#5 Stay safe online using hardware devices

If you want to take cyber security to the ultimate level, you may also consider using a new hardware-based approach to cyber security that does away with passwords altogether replacing them with asymmetric key cryptography. These FIDO2 devices are still bleeding edge and unfortunately, not many websites support it yet, which is why I will not go into more detail for now. If you want to know more, check out Yubico.