Whoops! pa$$w0rd1965 is better than “password”, but not by much. Some variation of “pa$$w0rd” in combination with a birth year has doubtless been used many times before—and hackers know this. A computer can run through all the possibilities in a matter of seconds, making a password like this one easy to hack.

Good guess, but not quite right. John, Paul, George and Ringo are household names, which is why this passphrase, although long, is not particularly secure. Computers are powerful enough to try millions of common phrases and well-known song lyrics in the blink of an eye—and as bands go, it doesn’t get much more well-known than the Fab Four. A good rule of thumb is that if you can search for and find a particular string of words in a search engine, it’s better to use something else as your passphrase.

Oh no! This one isn’t very strong at all. Common, simple, and trivially easy for a computer to crack.

Not true! There is a way to check for yourself. Click on the correct answer to find out how.

Oh no! You’re not reusing passwords, are you? Click on the correct answer to learn why this is a bad idea...

The CIA can see you. But it’s not just them…

Anyone who controls network traffic can see your activity, even if you’re Incognito. But they’re not the only ones...

Sure, but it’s not only the bad guys.

Almost. But it’s worse than you think.

Phishing attacks are definitely something to watch out for, but your backups won’t help you if you send your bank account login details to an attacker.

Trojan Horse malware, as the name implies, disguises itself as something harmless so that you download it onto your system. Definitely tricky, but having backups won’t protect you from these in all cases.

MITM attacks refer to hackers positioning themselves “in the middle” of two parties who are communicating with one another (or who think they’re communicating with one another). The hacker will then relay or alter the messages sent between those parties for malicious purposes. The best defenses against MITM attacks are strong endpoint authentication protocols and well-secured networks.

Usually true, but not always. Click on the correct answer to make sure your iPhone is working as intended.

This is generally a bad sign. Legitimate emails from banks or service providers will almost never ask for this kind of information. And no, the IRS or Apple will never call you on the phone to resolve an account issue.

This is a common trick used by malicious actors to make an email address seem like it comes from a legitimate organization, even though it’s anything but legit. Be on the lookout for addresses like payments@netflix123.com or refunds@irs.gov.cc.

This is generally an excellent sign that an email is a phishing attack. If the link that you’re supposed to click reads “www.uber.com/accounts/new/rewards” but holding your mouse over this text indicates that you’ll instead be taken to “www.uber.fakewebsite.com/accounts/new/rewards”, don’t click!

Another very common tactic that phishing emails use is to attach a malicious payload in the form of an attachment, often disguised as something innocent like a PDF or Word document. Never download something that you’re not sure about. Always use antivirus software to scan attachments before opening them.

You’re more paranoid than we are! Public Wi-Fi can be sketchy, but using a VPN on a public network is generally considered secure. You might want to avoid those USB jacks in the airport lounge, though—no telling who installed them.