Frequent Hacks - How to Ensure 'Digital Hygiene' Implementation?

By: blockbeats|2025/03/23 05:45:03
Share
copy
Original Author: @karpathy, Co-Founder of @EurekaLabsAI
Translation: zhouzhou, BlockBeats

Editor's Note: This article introduces some basic techniques to improve computer privacy and security, covering topics such as password managers, hardware security keys, disk encryption, biometrics, and other security measures. It recommends using security tools like 1Password, YubiKey, Signal, while emphasizing avoiding insecure smart devices, using privacy-focused browsers and search engines, and adopting VPNs and ad blockers. The article also suggests protecting personal information through virtual credit cards, email management, and network monitoring to achieve digital security.

The following is the original content (reorganized for readability):

Essentially, you can take some simple steps to improve your computer's privacy and security, and this article covers some of these.

From time to time, I am reminded of the vast fraud machinery of the internet, which reignites my pursuit of basic digital hygiene for everyday computer privacy/security. The problem starts with some major tech companies, which have the motivation to build a comprehensive profile of you to either monetize directly through ads or sell to professional data brokers who further enrich, de-anonymize, cross-reference, and resell the data.

Inevitable and frequent data breaches eventually aggregate your information into black-market archives, nurturing a vast underground spam/scam industry, including hacks, phishing attacks, ransomware, credit card fraud, identity theft, etc. This guide is a collection of some of the most fundamental digital hygiene tips, starting from the simplest and progressing to some slightly more nuanced suggestions.

Password Manager

Your password is your "first factor," i.e., "something you know." Do not foolishly set new, unique, complex passwords for every registered website or service. Combined with a browser extension, you can quickly create and autofill them. For example, I use and love 1Password. This helps prevent your passwords from being: 1) easy to guess or crack, and 2) once leaked, opening the doors to many other services. In return, we now have a central repository for all first factors (passwords), so it must be thoroughly protected, leading to...

Hardware Security Key

Your most critical services in life (e.g., Google or 1Password) must be further fortified with a "second factor," i.e., "something you have." Attackers must possess both of these factors to access these services. The most common second factor implemented by many services is a phone number, where theoretically, you receive an SMS with a PIN, entering which verifies you in addition to the password.

Obviously, this is much better than having no second factor, but using a phone number is known to be very insecure due to SIM card swap attacks. Basically, an attacker finds out that they can easily call your phone company, pretend to be you, and request them to switch your phone number to a new phone controlled by them. I know this sounds completely crazy, but it's true, and I have many friends who have been victims of this attack.

Therefore, buy and set up a hardware security key—an industrial-grade security standard. Specifically, I like and use YubiKey. These devices generate and store private keys on a secure element, so the private key never touches a general computing device like a laptop. Once you set up these devices, attackers not only need to know your password, but they also need to physically have your security key to log in to services.

Your risk is reduced by about 1000 times. Purchase and set up 2 to 3 keys and store them in different physical locations in case you lose one. Security keys support various authentication methods. Look for "U2F" in the second factor settings of your service for the strongest protection. For example, Google and 1Password support it. If you have to use "TOTP," note that your YubiKey can store TOTP private keys, so you can easily get the PIN code for login through NFC contact with your phone using the YubiKey Authenticator app.

This is much better than storing TOTP private keys in other (software) authentication apps because you should not trust general computing devices. This article is not intended to delve deep, but basically, I strongly recommend using 2-3 YubiKeys to significantly enhance your digital security.

Biometrics

Biometrics is the third common authentication factor ("who you are"). For example, if you are an iOS user, I suggest setting up Face ID almost everywhere, such as accessing apps like 1Password.

Security Questions. Dinosaur companies are obsessed with security questions (e.g., "What is your mother's maiden name?") and occasionally force you to set up these questions. Obviously, these questions fall into the "something you know" category, so essentially, they are passwords, but for scammers, these questions can be easily found on the internet, and you should refrain from participating in this absurd "security" practice. Instead, treat security questions like passwords, generate random answers for each question, and store them along with your password in your 1Password.

Disk Encryption. Always ensure that your computer uses disk encryption. For example, on Mac, this brain-dead simple feature is called "FileVault." This feature ensures that if your computer is stolen, attackers cannot access your data by taking out the hard drive.

Internet of Things

More like @internetofshit. Try to avoid using "smart" devices, which are essentially highly insecure, internet-connected computers that collect vast amounts of data, are frequently targeted by hackers, and yet people willingly place them in their homes. These devices have microphones, regularly send data back to the parent company for analysis to "improve customer experience," haha, yeah right. For example, in my young and naive days, I purchased a CO2 monitor from China that, before telling me the CO2 levels in the room, requested all my personal information and precise location. These devices are a massive privacy and security vulnerability and should be avoided.

Messaging. I recommend Signal over SMS because it encrypts all communications end-to-end. Additionally, it does not store metadata like many other apps (e.g., iMessage, WhatsApp). Turning on message disappearing (e.g., default 90 days is a good choice). In my experience, message disappearing is a privacy placebo with no significant benefit.

Browser. I recommend using the Brave browser, a privacy-first browser based on Chromium. This means almost all Chrome extensions work out of the box, the browsing experience is similar to Chrome, but without Google having a full grasp of your entire digital life.

Search Engine

I recommend Brave Search, which you can set as the default search engine in your browser settings. Brave Search is a privacy-focused search engine with its index, unlike DuckDuckGo, which is essentially a Bing skin and has to make some odd compromises with Microsoft compromising user privacy. Like all services on this list, I pay $3 a month for Brave Premium because I prefer to be a customer rather than the product in my digital life. By experience, I find that 95% of search engine queries are straightforward website searches. Search engines essentially act as a small-scale DNS. If you can't find what you're looking for, just add "!g" before your search query to be redirected to Google.

Credit Card

Fabricate a new, unique credit card for each merchant. There is no need to use the same credit card across multiple services, which would allow them to "associate" your purchasing behavior across different services, plus it increases the risk of credit card fraud as service providers might expose your credit card number. I like and use privacy.com to fabricate a new credit card for every transaction or merchant.

You can view all your expenses through a great interface and receive notifications for each card swipe. You can also set spending limits for each credit card (e.g., $50 per month), greatly reducing the risk of being charged unexpected fees. In addition, with privacy.com's cards, you can enter completely random names and addresses when filling out billing information. This is crucial because there is no need for those random online merchants to know your actual address. Next, let's talk about...

Address

Most random services and merchants do not need to know your actual address. Use a virtual mailbox service. I currently use Earth Class Mail, but to be honest, I am a bit hesitant, so I plan to switch to Virtual Post Mail because of its stronger commitment to privacy, security, ownership structure, and reputation. In any case, you can provide an address, they will scan and digitize the mail once received, and you can quickly view it through the application and decide how to handle it (e.g., destroy, forward, etc.). This way, you not only get security and privacy protection but also enjoy a considerable level of convenience.

Email

I still use Gmail because it is just too convenient, but I have also started using ProtonMail partially. Also, there are some thoughts on email. Never click on any links in the emails you receive. Email addresses are very easy to spoof, and you can never be sure if the email you received is a scam phishing email. Instead, I will manually enter any services of interest and log in from there.

Additionally, it is recommended to disable image loading in email settings. If you receive an email that requires viewing images, you can click "Display images" to view them, which is completely fine. This is important because many services track you by embedding images—they hide information in the image's URL, so when your email client loads the image, they can see if you opened the email. There is absolutely no need for this. Moreover, scammers often use obfuscated images to hide information and avoid being filtered as spam by email servers.

VPN

If you want to hide your IP or location, you can do so indirectly through a VPN. I recommend Mullvad VPN. I keep my VPN turned off by default, but I choose to turn it on when dealing with less trusted services to get more protection.

DNS-based ad blocker. You can block ads by intercepting entire domain names at the DNS level. I like and use NextDNS, which can block various ads and trackers. For advanced users who like to tinker, pi-hole is a physical alternative solution.

Network Monitoring

I like and use The Little Snitch, which is installed on my MacBook. This tool allows you to see which applications are communicating, the amount of data transferred, and when the transfers occur, helping you track which apps are "calling home" and understanding their frequency. If an app has excessive communication, that's suspicious, and it may need to be uninstalled unless you expect that kind of traffic.

I only aim for a secure digital life and seek to establish a harmonious relationship with products and services that only disclose necessary information. I am willing to pay for the software I use to motivate and align interests, ensuring that I am always a customer. It's not a small feat, but with determination and discipline, it can be achieved.

Original post link: Original Post Link

You may also like

a16z Leads $25M Investment, 0xMiden to Run a Privacy Chain on Your Phone

From Scalability to Compliance, Why Did This "Edge Blockchain" Project Win Top-Tier Capital Backing

The "Yearn Finance" Effect: Cryptocurrency Funds Experience the Calm Before the Dawn

For a crypto fund established during the pandemic-fueled era of easy money, the present is a painful reckoning from a "bad vintage."

Bitcoin Eco Goes 10x Again, What Is the New Asset Protocol Alkanes?

「Methane」 is the most popular term in the recent Bitcoin ecosystem, serving as the first fairly minted token of the new Alkanes protocol in the Bitcoin ecosystem. 「Methane」


The market value of METHANE has exceeded 6 million USD, which means each METHANE is worth over 60 USD. The author inquired with some Bitcoin ecosystem players who participated in the minting process, and there is a significant difference in minting costs. If we take 5 USD per token as the minting cost benchmark, then the profit from minting METHANE has already exceeded 10 times.



In the long stagnant situation of the Bitcoin ecosystem, how did this new asset protocol Alkanes emerge?


Protocol Background


The predecessor of the Alkanes protocol was called Protorunes, which means 「programmable runes,」 and it has the same founder. This thing also briefly caught the attention of the Bitcoin ecosystem last year, and runes were quite popular at that time.


The protocol's founder @judoflexchop is the Chief Technology Officer of the Bitcoin wallet Oyl Wallet. Although the number of users of this wallet in the Bitcoin ecosystem may not be very high, it is still well-known. Just look at its funding situation to understand why:


On March 8, 2024, the Bitcoin infrastructure company Oyl completed a 3 million USD Pre-Seed round of financing, led by Arca, with participation from Foresight Ventures, Arthur Hayes's family office Maelstrom, Domo, UTXO Management, Taproot Wizards CEO Udi Werthheimer, Kanosei, and FlamingoDAO, among others.


With Arthur Hayes's involvement, this wallet quickly gained prominence in the Bitcoin ecosystem. In the middle of last year, Oyl launched a Bitcoin NFT project called 「Airheads,」 which sparked controversy due to the relatively high minting price. In terms of the NFT's price performance, it was considered a 「failure」 project, but recently it has surged nearly three times in value due to the popularity of the Alkanes protocol.



Although they are all wallets, in the Bitcoin ecosystem, most major wallets are not just wallets. For example, OKX, UniSat, Magic Eden, and the main character of this article, Oyl, have various other Bitcoin ecosystem businesses outside of their wallets, with only Xverse having a more "focused" business scope. Returning to Oyl, in addition to the wallet, they have also developed a Bitcoin RPC called "Sandshrew" and the Alkanes protocol.


Currently, Oyl is fully focused on promoting this protocol, and the official promotion has also adopted the name Alkanes:



Reasons for Its Popularity


Alkanes is a new Bitcoin asset protocol. Overall, it draws on the "Runestone" structure of the Rune protocol, but with greater scalability and support for smart contracts. As mentioned earlier, the predecessor of this protocol was Protorunes. At first glance, Protorunes may seem like a "customized version of Rune," but it is not. In simple terms, the Rune protocol and the "Runestone" structure are like a closed iOS system, while Protorunes and Alkanes are like open-source Android.


Protorunes corresponds to the "Runestone" of the Rune protocol. Here, "Runestone" is not the highly valuable early NFT of the Rune system but rather a "transaction data encapsulation," in short, a piece of information embedded in a Bitcoin transaction that serves as an index to determine if there is any Rune operation in the transaction.


If the indexer discovers the "RUNES" identifier while scanning the OP_RETURN of each transaction, it interprets the data following the identifier, such as etching, minting, transferring, and so on. The "Runestone" acts as an operational guide, and the indexer derives indexing results based on this guide.


The "Runestone" is exclusively for the Rune protocol's operational guide, directly corresponding to the Rune protocol, unlike Protorunes. Simply put, we cannot instruct the indexer of the Rune protocol to perform such actions directly, saying, "I am a sub-asset protocol based on Runestone; please index me together." However, Protorunes can. Everyone can customize their new asset protocol based on the Protorunes data format, and these protocols will be assigned a "Protocol ID." The indexer will read the "Protocol ID" to determine which protocol's specifications to parse.


There are some modular blockchain launch frameworks like Ethereum's, which make things simpler. For developers, they can just use the tools provided by Oyl instead of having to build their own indexer.


On the smart contract implementation front, before OP_CAT's revival, it was basically limited to storing contract data in transactions and executing off-chain indexes, not deviating too much from that approach.


On a technical level, apart from technology, there are two main reasons why this protocol could gain momentum. Firstly, it has received strong support from the Chinese inscription player community. Undoubtedly, the most financially capable group in the Bitcoin ecosystem currently is the Chinese inscription player community. This group is quite unique, as the PvP aspect of Solana meme coins is redundant in the Bitcoin ecosystem, but gaining approval from the Chinese inscription player community is also quite challenging. Once the inscription gains momentum, the spread speed within WeChat groups will be rapid and influential.


Searching for the keyword "Alkanes" on Twitter, one will find that most of the content comes from Chinese users, and the protocol's founder has also posted Chinese tweets thanking the Chinese community for their support. The early Bitcoin ecosystem minting tool, iDclub, created a transaction market for the Alkanes protocol, also coming from Chinese hands.


The second reason is that the project team behind this protocol has a background, and according to their disclosed plans, they don't just intend to launch an asset protocol to "funnel" into their own wallet. They also plan to develop AMM, BTC staking, stablecoins, MEV tools, and a trustless ZK bridge, essentially creating a BTCFi ecosystem around this protocol.


The entire narrative logic is coherent—a smart contract-supported asset protocol used to build applications around it. Without the backing of the project team to explain this narrative, it's hard to convince people. After all, in the Bitcoin ecosystem, players still feel some pain from Atomicals' decline, and there is too much uncertainty when big things are not done by a mature team.


Protocol Leaders


- METHANE, the first fairly minted token of the Alkanes protocol, currently with a market cap of about $6 million. The Chinese meaning of Alkanes is "alkanes," while the Chinese meaning of METHANE is indeed "methane," so players also mention BUTANE "butane" and HEXANE "hexane," but these two tokens currently have market capitalizations of only around $250,000 each.


- DIESEL, from the official team and also the first token deployed by the Alkanes protocol, currently valued at around $12.6 million. This coin has a unique mechanism, with a total supply of only 1,562,500 tokens, 28% reserved for the team, and 72% being produced block by block along with each Bitcoin block, with production halving following Bitcoin's halving schedule. In each block, the miner who submits the highest fee for a DIESEL minting transaction will ultimately receive the block's DIESEL output. In summary, a DIESEL is minted per block, and only one person (the miner whose fee for the minting transaction was the highest) can mine DIESEL in each block. Ordinary players can hardly mint anymore, and scientists will automatically monitor and increase the miner fee continuously.


Since METHANE is fairly launched, the holder base/chip distribution is definitely healthier compared to DIESEL, and it is fully circulating. Therefore, currently on social media platforms, the volume of METHANE is much higher than that of DIESEL. Purely based on volume rather than market value, it would feel like METHANE is leading the pack. There is no information available from the official sources about DIESEL's future empowerment. Thus, in terms of community engagement, METHANE is far superior, while DIESEL excels in official background and potential future empowerment expectations.


Conclusion


This protocol is still in its very early stages. Various wallets have not caught up with support for assets of this protocol yet, so it is best to use Oyl Wallet for interacting with assets of this protocol to ensure asset security.


Essentially, the success of this protocol has ticked off all the key success factors of a new asset protocol in the Bitcoin ecosystem — "Mainnet Asset," "Fair Launch," and "Community Support." Additionally, it has "Smart Contracts" and a narrative on the ecosystem layer. In the long-standing quietness of the Bitcoin ecosystem, it has still managed to stand out. Hopefully, the ecosystem can be further developed and progress even further in the future.

**The Crypto AI Evolution: How Will Automated Trading by AI Agents Reshape the Market?**

A cryptocurrency AI agent is a self-operating artificial intelligence program that can analyze markets, manage assets, and perform blockchain tasks without human intervention.

Please have all trading platforms immediately cease promoting contract trial funding behavior to college students

If the industry truly seeks long-term development, it should first abandon a growth model that sacrifices the future of a generation.

This Week in Review | Strategy Adds BTC Sell Risk Warning Sparking Debate; US Tariff Policy Flip-Flops Cause Market Turbulence

US IRS DeFi Cryptocurrency Broker Rule Repealed; Paul Atkins Officially Named Chair of the US SEC; TRUMP Token to Unlock 40 Million Tokens on April 18; Aave Launches Token Buyback Mechanism

Popular coins

Latest Crypto News

Read more