The everyday computer, internet, safety and AI skills every tech and STEM job assumes you already have.

Digital Literacy for Tech & STEM Work

Choose a password manager and install or enable it on your main device.

Create a master passphrase of at least four random words that you have never used before, and write a backup copy to keep somewhere safe offline.

Turn on 2FA for the password manager itself, if it supports it.

Open your main email account's security settings and replace its password with a long generated one saved in the manager.

Turn on 2FA for that email account, using an authenticator app or a passkey if offered (SMS only if nothing else is available).

Save the recovery codes in the password manager or print them and store them safely.

Sign out and sign back in to check that the manager fills the password and 2FA works.

Run the manager's password health or breach check and pick one weak or reused password to change this week.

## Why it matters

Most account takeovers do not involve clever hacking. They happen because someone reused a password that leaked from another site, chose one that is easy to guess, or typed it into a fake login page. In technical jobs your accounts often reach code, cloud resources, lab systems or customer data, so a takeover hurts more than you. Two tools fix most of the problem: a **password manager** and **two-factor authentication (2FA)**.

## The core problem: reuse and guessability

When a website is breached, attackers often get a list of email addresses and passwords (or password hashes they can crack). They then try those same pairs on email, banking and work sites. This is called **credential stuffing**, and it works because people reuse passwords.

A strong password is:

- **Unique:** used on one site only. This matters most.
- **Long:** length beats clever symbols. A random passphrase of four or more unrelated words, or a generated string of 15+ characters, is far harder to guess than `P@ssw0rd!`.
- **Not personal:** no names, birthdays, pets or teams.

The US standards body NIST, in its digital identity guidelines (SP 800-63B), recommends favouring length, checking passwords against known-breached lists, and *not* forcing regular changes unless there is evidence of compromise. Many organisations now follow that advice.

Nobody can remember dozens of long unique passwords. That is the job of a password manager.

## Password managers

A password manager is an encrypted vault for your passwords. You remember one strong **master password** (or unlock with your device's fingerprint or face); the manager remembers the rest.

What it does for you:

- **Generates** long random passwords for each site.
- **Fills them in** automatically, but only on the real site's domain. If you land on `paypa1-login.com`, it will not offer your PayPal password, which is a useful phishing alarm.
- **Syncs** across your devices.
- **Warns** you about reused, weak or breached passwords.

Options include the managers built into your browser or operating system (Google Password Manager, iCloud Keychain / Apple Passwords, Microsoft Edge) and dedicated apps (for example Bitwarden, which has a free tier, 1Password, or KeePassXC, which is free and stores the vault as a file you control). At work, use the manager your employer provides.

Protect the vault: make the master password a long passphrase you have never used anywhere, turn on 2FA for the manager itself, and store its recovery information somewhere safe offline.

## Two-factor authentication

2FA (also called multi-factor authentication, MFA) asks for a second proof besides your password: something you **have** (a phone, a security key) or **are** (fingerprint). A stolen password alone is then not enough.

Common methods, from strongest to weakest:

1. **Passkeys and hardware security keys** (FIDO2/WebAuthn). They are tied to the real site and resist phishing.
2. **Authenticator app codes** (TOTP): an app such as Google Authenticator, Microsoft Authenticator, or your password manager shows a 6-digit code that changes every 30 seconds.
3. **Push approvals**: tap "Approve" on your phone. Only approve sign-ins *you* started.
4. **SMS or email codes**: much better than nothing, but texts can be intercepted or a number hijacked (SIM swapping).

### Recovery codes

When you turn on 2FA, most services give you a set of one-time **recovery codes**. If you lose your phone, these let you back in. Save them in your password manager or print them and store them safely. Coding Help works the same way: you can turn on 2FA from the Security tab of your profile, and it shows recovery codes once.

## Worked example: securing your email first

Your email account is the master key: password resets for every other account go there. So start there.

1. Install a password manager and create the vault with a strong passphrase, for example four random words joined with hyphens. Never use a phrase from a song or a quote.
2. In your email account's security settings, change the password to a generated one saved in the manager.
3. Turn on 2FA with an authenticator app (or a passkey if offered).
4. Save the recovery codes in the manager.
5. Repeat for your most important accounts: work or school, bank, cloud storage, code hosting, then the rest over time.

## Common mistakes

- **Reusing one "strong" password everywhere.** One breach exposes all of them.
- **Reading a 2FA code to someone who phones you.** No real support team asks for your code. That call is an attack.
- **Approving a push notification you did not start** ("MFA fatigue" attacks send many until you tap yes).
- **Losing recovery codes**, then losing the phone.
- **Storing passwords in a plain text file or spreadsheet** on your desktop.

## Quick recap

- Unique passwords matter most; long beats complex.
- A password manager generates, stores and fills them, and helps spot fake sites.
- 2FA stops most takeovers; passkeys and authenticator apps beat SMS.
- Secure your email first and keep recovery codes safe.

## Try it

Open the Do tab and set up a password manager and 2FA on one real account.


Set up a password manager and two-factor sign-in so one leaked password cannot take over your accounts.

Passwords, managers, and 2FA

How Password Managers Work - Computerphile

Why You Should Turn On Two Factor Authentication

## Why it matters

Phishing is a message that pretends to come from someone you trust so that you click a link, open an attachment, hand over a password or code, or send money. It is one of the most common ways attackers get into organisations, because it targets people rather than software. Technical staff are prime targets: their accounts can reach source code, cloud consoles, lab systems and payroll.

Phishing arrives as email, text (smishing), phone calls (vishing), chat messages, social media and even QR codes.

## The core idea: pressure plus a request

Almost every scam combines two things: **pressure** that stops you thinking, and a **request** to act now. If a message creates strong emotion (fear, excitement, urgency) and asks you to do something with credentials, money or files, slow down.

## Five signs of a phishing message

### 1. Urgency or threats

"Your account will be closed in 24 hours." "Unusual sign-in detected, verify now." "Your parcel is held, pay the fee today." Real organisations rarely demand instant action through a link.

### 2. A sender that does not match

The display name says "IT Support" but the address is `it-support@helpdesk-securemail.net`. Look at the actual address and domain. Watch for lookalikes: `rn` posing as `m` (`rnicrosoft.com`), `0` for `o`, extra words (`amazon-account-verify.com`). A message *can* also come from a real but compromised account, so a familiar sender is not proof on its own.

### 3. Links that go somewhere else

The link text says `https://yourbank.com` but points somewhere different. On a computer, hover over the link (do not click) and read the real address that appears, usually at the bottom of the window. On a phone, press and hold to preview. Read the domain from right to left: in `yourbank.com.secure-login.io/account`, the real domain is `secure-login.io`, not your bank.

### 4. Requests for credentials, codes, payment or secrecy

Asking you to "confirm your password", read back a 2FA code, buy gift cards, change bank details for an invoice, or "keep this between us" are classic signs. Legitimate services do not ask for your password or codes by email, text or phone.

### 5. Unexpected attachments or too-good offers

An invoice you were not expecting, a "shared document" that asks you to sign in to view it, a `.zip`, `.html`, or Office file that asks you to "enable content" or macros. Or a prize, refund or job offer that seems too good to be true.

Spelling mistakes and odd greetings ("Dear Customer") are also clues, but modern scams, often written with AI tools, can be perfectly polished. Do not rely on bad grammar to protect you.

## Worked example

You receive this email:

```text
From: Microsoft 365 Admin <no-reply@m365-security-alerts.com>
Subject: ACTION REQUIRED: Mailbox storage full - messages will be deleted

Your mailbox has reached its limit. Incoming mail will be deleted in 2 hours.
Click below to sign in and keep your messages.

[ Keep My Messages ]   (link: https://m365-security-alerts.com/login)
```

Checklist:

1. **Urgency:** deleted "in 2 hours". Yes.
2. **Sender:** `m365-security-alerts.com` is not a Microsoft domain or your organisation's domain. Yes.
3. **Link:** the button goes to the same lookalike domain. Yes.
4. **Request:** sign in, which means hand over your password. Yes.

Four of five signs. Do not click. If you are worried about your mailbox, open your mail the usual way (a bookmark or typing the address) and check there.

## What to do

- **Do not click, reply, or open attachments.** Do not scan the QR code.
- **Verify through a separate channel.** Type the organisation's address yourself, use its official app, or phone a number you already know. Never use the contact details in the suspicious message.
- **Report it.** At work, use the "Report phishing" button or tell your IT or security team; that is their job and they want to know. In the US you can report to the FTC at reportfraud.ftc.gov and forward scam texts to 7726 (SPAM); other countries have their own reporting services.
- **If you already clicked or entered details:** tell IT straight away, change the password from a trusted device (and anywhere you reused it), check that 2FA is still on, and contact your bank if payment details were involved. Reporting quickly limits the damage. Nobody good at security will blame you for reporting.

## Common mistakes

- Trusting a message because it uses the right logo or your name.
- Assuming phone calls and texts are safer than email.
- Using the phone number or link in the message to "verify" it.
- Staying quiet after clicking because you are embarrassed.
- Thinking a padlock on the page means the site is legitimate.

## Quick recap

- Phishing = pressure + a request for credentials, codes, money or files.
- Check five signs: urgency, sender mismatch, misleading links, sensitive requests, unexpected attachments or offers.
- Verify through a separate, trusted channel.
- Report it, and if you clicked, report fast.

## Try it

Open the Do tab and take the quiz to practise spotting the signs.


Recognise the five most common signs of a phishing message and know what to do when one arrives.

Spotting phishing and scams

Recognize and Report Phishing

Teach students to recognize phishing and scams

Search your full name (in quotes) in a private browser window and note the first page of results.

Pick one account and open its privacy or security dashboard.

Check who can see your profile, posts, email and phone number, and tighten anything that is more public than you want.

Review location history and activity history; turn off what you do not need or set auto-delete.

Open the list of connected third-party apps and remove any you no longer use.

On your phone, open the permission manager and remove location, camera, microphone or contacts access from at least one app that does not need it.

Optional: request a data download from the account and skim what it contains.

Write down one thing you changed and one thing you want to add to your professional footprint (for example a portfolio link).

## Why it matters

Everything you do online leaves traces: posts, comments, photos, sign-ups, purchases, location history and the data apps collect in the background. Employers, clients and admissions teams often search candidates' names. Scammers use public details to make phishing convincing. And in many technical jobs you will handle other people's data, so understanding privacy from the user's side makes you better at protecting it.

## The core idea: active and passive footprints

Your **digital footprint** is the record you leave online.

- **Active footprint:** what you share on purpose: social posts, profile details, forum answers, a portfolio, reviews.
- **Passive footprint:** what is collected without you typing anything: IP address, device details, location, browsing activity tracked by cookies and ad networks, app usage, and data that **data brokers** gather and sell.

Some of your footprint is an asset. A tidy professional profile, a portfolio of projects and helpful forum answers show employers what you can do. The goal is not to disappear; it is to **decide** what is out there.

## What to look at

### Account privacy settings

Most large services have a privacy or security dashboard. Common settings to review:

- **Profile visibility:** who can see your posts, friends list, email and phone number.
- **Location history:** whether the service keeps a timeline of where you have been.
- **Activity history:** search, video and voice history, and auto-delete options.
- **Ad personalisation:** whether your activity is used to target ads.
- **Third-party apps:** which outside apps and sites are connected to your account ("Sign in with...") and what they can access. Remove ones you no longer use.
- **Data download:** most services let you export your data, which is an eye-opening way to see what they hold.

### Phone and app permissions

Apps ask for location, camera, microphone, contacts and photos. Check them in your phone's settings (Android: Settings > Security & privacy or Privacy > Permission manager; iPhone: Settings > Privacy & Security; menu names vary slightly by version). Ask: does a flashlight app need my contacts? Choose "only while using the app" for location where possible.

### Browser

Browsers can block third-party cookies, send fewer tracking signals, and clear history on exit. **Private or incognito mode** stops the browser keeping history on your device, but it does **not** hide what you do from websites, your employer's network, or your internet provider.

## Worked example: a five-minute privacy review

Sam is about to apply for jobs and searches their own name in a private browser window.

1. **Search results:** an old gaming forum profile with their full name and home town, and a public photo album from years ago.
2. **Action:** Sam deletes the old forum account and sets the album to private.
3. **Main social account:** Sam opens the privacy settings, sets past posts to friends-only, hides their phone number and email from the profile, and removes four old connected apps.
4. **Location:** Sam turns off location history and sets auto-delete for activity to three months.
5. **Professional profile:** Sam updates a professional networking profile with current skills and a link to a project portfolio, so a search now shows something useful first.

## Privacy at work

At work, other people's data is in your hands: customer records, patient samples, employee details, research participants. Laws such as GDPR in Europe, HIPAA for US health information and many others set rules about collecting, storing and sharing it. You do not need to be a lawyer, but you do need habits:

- Only collect and keep the data the task needs.
- Store it only in approved systems, never in personal cloud folders or chat apps.
- Do not paste personal or confidential data into public AI tools or online converters.
- Ask your manager or data protection contact when unsure.

On Coding Help, you can review your own privacy choices and download a copy of your data at Settings > Privacy.

## Common mistakes

- Thinking deleted posts are gone. Screenshots, archives and backups may keep them.
- Sharing details that answer common security questions (first pet, school, mother's maiden name).
- Granting every app permission on install and never reviewing them.
- Posting photos that show badges, screens, whiteboards or documents from work.
- Believing incognito mode makes you anonymous.

## Quick recap

- Your footprint has active (what you share) and passive (what is collected) parts.
- Review account visibility, location and activity history, ads, connected apps and phone permissions.
- Shape your footprint: hide what does not help, build what shows your skills.
- At work, treat other people's data with the same care, and follow your organisation's rules.

## Try it

Open the Do tab and do a privacy review of one account you use often.


Understand what your digital footprint is and review the privacy settings on one of your accounts.

Privacy and your digital footprint

What Is a Digital Footprint?

Privacy and Security in Chrome

Password managers and two-factor sign-in, spotting phishing and scams, and managing your privacy and digital footprint.