Baseline Account Security Checklist
Block common account attacks with updates, unique credentials, and passkeys
- Difficulty
- Easy
- Time to result
- ~days to results
- Steps
- 5
- Confidence
- 98%
Mullenweg's baseline starts with prompt software maintenance because actively exploited vulnerabilities exist in operating systems, apps, and browsers. Account security then shifts from memorable passwords to generated, unique credentials stored in a password manager; the same password should never appear on multiple services. Where available, passkeys improve the model by using a public-private key exchange and a device-protected private key, while presenting a simple face or fingerprint login to the user. The public key can remain on the service without granting access, while the private material stays secret. This checklist does not claim to defeat every targeted attack. It removes several common and avoidable weaknesses that attackers routinely exploit and gives non-technical users a manageable security routine.
Origin
Mullenweg gives Ferriss basic security advice and explains why passkeys improve on reusable passwords.
Core principles
- 01Patch actively exploited vulnerabilities quickly
- 02Never reuse a password across services
- 03Generate credentials rather than memorizing weak ones
- 04Prefer passkeys where services support them
- 05Keep private authentication material on trusted devices
How to run it
- 1
Patch every layer
Install current operating-system, application, and browser updates instead of postponing them indefinitely.
Pro tip Make checking updates a regular routine rather than an emergency response.
Watch out Known vulnerabilities may already be actively exploited.
- 2
Centralize credential storage
Use a reputable password manager to generate and retain credentials you do not need to memorize.
Pro tip Mullenweg names 1Password as an example.
Watch out Do not store a plain-text password list in an unprotected document.
- 3
Eliminate reuse
Replace every repeated password with a unique random credential for that service.
Pro tip Use long generated values rather than personal patterns.
Watch out One breached service can expose every account that shares its password.
- 4
Adopt passkeys
Switch supported accounts to passkeys and use the operating system or password manager to protect the private key.
Pro tip Start with important accounts that already offer passkey enrollment.
Watch out Confirm that account recovery is configured before removing an older login method.
- 5
Protect the device
Use strong local authentication so a face, fingerprint, or device credential gates access to protected keys.
Pro tip Treat the device as part of the authentication system, not merely a display.
Watch out A passkey cannot compensate for an unlocked, untrusted device.
In the wild
A user finds that the same password protects email, shopping, and social accounts. They move the accounts into a password manager, generate a different long credential for each one, and enable a passkey where the service supports it.
→ A breach at one service no longer supplies the credential for the other accounts.
Common mistakes
Reusing one strong password
Strength does not remove the cross-service risk created when the same secret is exposed by one provider.
Ignoring browser updates
Browsers process untrusted internet content and belong in the same patch routine as the operating system.
Is it for you?
Best for
Non-technical users who need a practical baseline for protecting everyday devices and online accounts.
Not ideal for
People facing a targeted, high-risk threat model that requires professional security assessment and additional controls.
From the transcript
“Make sure your apps and operating system are always up-to-date.”
“The thing that breaks my heart is when people use the same password on multiple services. Never do that.”
“If a service supports passkeys, you should switch to it.”
From the episode
#713: Matt Mullenweg — The Art of Crafting a Sabbatical, Tips for Defending Against Hackers, Leveraging Open Source, Thriving in an AI World, and Tips for Life’s Darkest Hours
Matt Mullenweg