Blog

<h2>The Public Wi-Fi Habit I Finally Broke</h2>For years my first move at a coffee shop, airport or hotel was the same. Order first, then find the Wi-Fi password, then get on with whatever I needed to do, usually without a second thought about which network I was actually joining. Free Wi-Fi felt like a small convenience everyone was entitled to, the digital equivalent of asking for tap water. It never occurred to me that the network itself might be the problem rather than whatever I did once connected to it. What changed my thinking wasn't a single dramatic incident. It was a slow accumulation of small things I read and heard about how easy public networks are to abuse, until the convenience stopped feeling worth the risk I'd been ignoring. <h2>What's Actually Happening When You Join a Public Network</h2> The basic issue with most public Wi-Fi is that you have no way of verifying who actually controls it. A network called "Cafe Wi-Fi" could be the genuine router behind the counter, or it could be a laptop sitting in someone's bag two tables away, broadcasting a nearly identical name and waiting for people to connect. This is often called an evil twin, and it works precisely because nobody stops to check. You see a familiar-sounding name, you join, and from that point on your traffic can pass through a device controlled by someone with no good reason to be watching it. Even on a genuine, honestly-run network, the risk doesn't disappear entirely. Many public hotspots still use weak or no encryption between your device and the router, which means anyone else on the same network with the right tools can potentially see unencrypted traffic passing by. Most websites now use HTTPS, which protects the contents of what you're sending, but it doesn't hide which sites you're visiting or protect you from a network that's been set up specifically to intercept traffic before it gets that far. <h2>The Moment I Actually Got Nervous About It</h2> The thing that actually pushed me to change my habits was working out how little effort an evil twin hotspot takes to set up. It's not a specialist attack requiring rare skill or expensive equipment. The tools are freely available, and a rogue hotspot can be running within minutes on a device no bigger than a phone, sitting quietly in someone's pocket in a busy departure lounge. Once I understood how low the bar actually was, the odds stopped feeling abstract. It wasn't about whether someone would bother targeting me specifically. It was about how easy it had become for anyone to cast a wide net and see what wandered in. I also thought back to how casually I'd used public Wi-Fi for things that actually mattered, checking my bank balance while waiting for a flight, logging into work email from a hotel lobby, <a href="https://kellssecurity.com/blog/the-checkout-red-flags-i-check-before-i-enter-my-card-details" data-mce-href="https://kellssecurity.com/blog/the-checkout-red-flags-i-check-before-i-enter-my-card-details">entering my card details on impulse </a>to finish an order before boarding. None of that felt risky at the time because none of it felt different from doing the same things at home. That was exactly the assumption I needed to unlearn.<figure id="figure-l940dqqiagmtd2o5qr"><img id="l940dqqiagmtd2o5qr" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Woman using a laptop in a coffee shop on public Wi-Fi, The Public Wi-Fi Habit I Finally Broke" src="https://cdn.durable.co/covers/39Q9hBBQ4sG4Th8bNtVZ4BzVDjXU8Evw7zaz5TKV76EDqP1JvlbicNL2jskqjiZ0.jpg" alt="Woman using a laptop in a coffee shop on public Wi-Fi, The Public Wi-Fi Habit I Finally Broke" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/39Q9hBBQ4sG4Th8bNtVZ4BzVDjXU8Evw7zaz5TKV76EDqP1JvlbicNL2jskqjiZ0.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure> <h2>What I Actually Do Differently Now</h2> The single biggest change is that I don't do anything sensitive over public Wi-Fi without a VPN running first. I've written before about <a href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from" data-mce-href="https://kellssecurity.com/blog/what-a-vpn-actually-protects-you-from">why I run a VPN on every device I own</a>, and public networks are the clearest example of why that matters. A VPN encrypts my connection before it ever reaches the local network, so even if I've genuinely joined a rogue hotspot, whoever's running it sees encrypted traffic they can't do anything useful with. I also stopped letting my devices auto-connect to open networks. That setting exists for convenience, but it means your phone can join a network you never actively chose, sometimes without you noticing at all. Turning it off adds a few seconds of friction when I actually want to connect somewhere, which is a small price for not being quietly joined to networks I haven't looked at. Where possible I check with staff which network is genuinely theirs rather than trusting whichever name looks most plausible. It takes ten seconds and it's caught a mismatched network name more than once. And for anything involving money or login details specifically, I've got into the habit of just using my phone's mobile data instead of hunting for Wi-Fi at all, especially somewhere like an airport where the incentive for a rogue hotspot is highest. <h2>The One Change That Made the Rest Unnecessary</h2> If I'm honest, <a href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902" target="_blank" rel="noopener" data-mce-href="https://go.nordvpn.net/aff_c?offer_id=15&amp;aff_id=131235&amp;url_id=902">the VPN habit </a>is the one that's done the most heavy lifting, because it means I don't have to correctly judge every network I encounter in order to stay protected. I'm not always going to spot an evil twin, and I'm not always going to remember to ask staff which name is real, especially when I'm tired or rushing for a gate. Having encryption running by default means those lapses matter less, because the thing that actually protects sensitive data isn't my vigilance in the moment, it's a habit that's already switched on before I've even opened the network list. None of this means I've stopped using public Wi-Fi altogether. It's genuinely useful, and refusing to touch it entirely isn't realistic for most people, myself included. What changed is that I stopped treating it as equivalent to my home network, and started treating it as a space I pass through carefully rather than one I settle into without thinking. That one shift in attitude, more than any single tool, is what actually closed the gap I'd been ignoring for years. If you want a fuller rundown of the other basics I'd put in place alongside this, I've pulled them together in a <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">free Safety Toolkit</a>. For wider guidance on staying safe on public networks from the UK's national authority on the subject, the <a href="https://www.ncsc.gov.uk/cyberaware/home" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk/cyberaware/home">NCSC </a>has clear advice worth reading too.I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.

The Public Wi-Fi Habit I Finally Broke

<h2>The Password Habits That Finally Caught Up With Me</h2>For years I ran the same handful of passwords across dozens of accounts, tweaking a number or a punctuation mark here and there when a site insisted I change it. I told myself I'd remember them because they all followed a pattern only I would know. Then a service I used got breached, and within days I was getting login attempts on accounts that had nothing to do with that service, just because I'd reused a version of the same password everywhere. That was the point I stopped treating password habits as a minor inconvenience and started treating them as one of the biggest gaps in my own security. If you're picking one for the first time, I've written up <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">how I'd choose a password manager</a> from scratch. <h2>What Changed Once I Started Using a Password Manager</h2>Switching over felt like a chore I kept putting off, mostly because I assumed it would slow me down every time I logged into something. In practice it did the opposite. I now have a genuinely random, unique password on every account I own, and I never have to remember a single one of them beyond the master password that unlocks the vault. Logging in got faster, not slower, because the manager fills the details in for me the moment I land on a login page I've used before.<figure id="figure-o0etw5oytfmtd1n9la"><img id="o0etw5oytfmtd1n9la" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: center center;" title="Man smiling as he uses his phone safely, Why I Finally Switched to a Password Manager" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, Why I Finally Switched to a Password Manager" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: center center;"></figure> The bigger shift was psychological. I stopped feeling that low background anxiety about whether an old password of mine was floating around in some leaked database somewhere. If one account does get compromised, it's isolated. Nothing else I own shares that password, so there's nothing for an attacker to try next. It also changed how I think about new accounts. I used to hesitate before signing up for a new service because it meant coming up with yet another password to remember, which often meant reusing something I already had. Now I don't think about it at all. The manager generates something long and random, saves it, and I move on. Creating an account went from a small chore to something that takes seconds, which sounds trivial but adds up over the dozens of accounts most of us end up with over a few years. <h2>The Features I Actually Use Day to Day</h2>I settled on <a href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356" target="_blank" rel="noopener" data-mce-href="https://go.nordpass.io/aff_c?offer_id=488&amp;aff_id=131235&amp;url_id=9356">NordPass </a>after comparing a few options, mainly because of how it handles the parts I actually use rather than the parts that look good in a features list. The password generator creates long, random strings I'd never come up with myself, and it autofills them without me having to copy and paste anything, which is the habit that used to get me into trouble in the first place. The breach monitoring is the feature I didn't expect to rely on so heavily. It flags if any of my saved logins show up in a known data breach, which means I find out and change that one password within days rather than months later when something actually goes wrong. I also use the secure notes feature for things like Wi-Fi passwords and software licence keys, so they're not scattered across sticky notes and random text files anymore. <h2>What I'd Say to Someone Who Thinks They Don't Need One</h2>The most common thing I hear is some version of "I don't have anything worth stealing," which misunderstands what's actually at risk. It's rarely about one dramatic hack. It's about a scammer finding a password from an old breach, testing it against your email and banking logins, and getting in because you reused it somewhere convenient. I've written before about the <a href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today" data-mce-href="https://kellssecurity.com/blog/how-id-choose-a-password-manager-if-i-were-starting-today">difference between using a password manager and just memorising everything</a>, and the short version is that human memory simply isn't built to hold dozens of genuinely random strings, so we end up choosing patterns that are easier to guess than we think. The other thing worth saying is that a strong password habit doesn't cancel out other risks. Phishing emails are still designed to trick you into typing your password into a fake login page, manager or no manager, so it's worth <a href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything" data-mce-href="https://kellssecurity.com/blog/how-i-spot-a-phishing-email-before-i-click-anything">knowing what a convincing fake actually looks like</a> rather than assuming your inbox will always flag it for you. <h2>Setting It Up Properly Took Less Time Than I Expected</h2>I'd built this up in my head as a weekend project, and it took me under an hour to import my existing passwords, set a strong master password, and install the browser extension and phone app. The slow part, if there is one, is going back through your accounts over the following weeks and swapping out the old reused passwords for freshly generated ones as you log into each site naturally. I didn't try to do it all in one sitting. I just let the manager flag weak or duplicate passwords and worked through them a few at a time. The one piece of advice I'd pass on is to actually write down your master password somewhere safe and offline while you're getting used to the system, rather than trusting yourself to remember a brand new phrase under pressure. It's the single password you can't afford to lock yourself out of, so it deserves a bit more care than the rest. Once it's memorised properly, that note can go. If you want a fuller walkthrough of the other basics I'd put in place alongside this, I've pulled them together in a free <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a>. And for wider guidance on protecting your accounts from the UK's national authority on the subject, the <a href="https://www.ncsc.gov.uk" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk">NCSC </a>has clear advice worth reading too. Looking back, the actual effort was tiny compared to how much background stress it removed. I'm not managing dozens of half-remembered passwords in my head anymore, and that's one less thing that can quietly go wrong.I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.

Why I Finally Switched to a Password Manager

<h2>Why I Stopped Trusting Free Antivirus Software</h2>For years I ran whatever antivirus came pre-installed on my laptop, or whichever free tool had decent reviews that week. It felt like enough until it wasn't. A few years back I clicked through to download what looked like a legitimate file and ended up with malware sitting quietly on my machine for weeks before my free antivirus flagged anything at all. By then it had already been reading through folders it had no business touching. That was the point where I stopped treating antivirus software as a box to tick and started actually researching what I was installing and why. If you're comparing options, I've set out how I choose <a href="https://kellssecurity.com/blog/how-i-actually-compare-antivirus-software" data-mce-href="https://kellssecurity.com/blog/how-i-actually-compare-antivirus-software">the best antivirus software in the UK</a> in a separate guide.<figure id="figure-qqtd875tw7mtd0zb37"><img id="qqtd875tw7mtd0zb37" class="object-cover bg-gray-100 rounded-2xl md:rounded-3xl lg:rounded-4xl" style="aspect-ratio: 16/9; object-position: undefined undefined;" title="Man smiling as he uses his phone safely, Is Bitdefender Worth It? The Antivirus I Actually Trust" src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" alt="Man smiling as he uses his phone safely, Is Bitdefender Worth It? The Antivirus I Actually Trust" data-corners="default" data-aspect="16:9" data-caption="" data-positionx="undefined" data-positiony="undefined" data-fullwidth="false" data-mce-src="https://cdn.durable.co/covers/22JGHvhqAR5zn3MLuxQlQkBE0erI5OO5GkH1wdZLu1DaA6xHoKImht9cHhDDTgyq.jpg" data-mce-style="aspect-ratio: 16/9; object-position: undefined undefined;"></figure> <h2>What I Actually Look For Before Installing Anything</h2>These days I judge antivirus software on a handful of things rather than star ratings alone. Real-time protection matters more than scheduled scans, because most threats do their damage in the seconds after a bad link is clicked, not hours later when a scan happens to run. I also look at how much a program slows my laptop down day to day, since protection I end up disabling because it's annoying isn't protection at all. Independent lab results carry more weight with me than marketing claims, and I pay attention to how a company handles ransomware specifically, since that's the threat that can do the most damage to a household in one sitting. Price matters too, but not in the way it used to. I'd rather pay for something that actually works than save a few pounds a year on a free tool that only catches the obvious stuff. My data, my banking details, and my family's photos aren't worth gambling on a free download that funds itself through pop-ups and upsells. Multi-device coverage matters more to me now too. Between my own laptop, my phone, and a couple of devices I help family members manage, I needed something that covered a handful of machines under one plan rather than paying separately for each. It's a small thing, but it's the difference between everyone in the house actually being protected and just the one laptop I happen to think about most. <h2>Why Bitdefender Is the One I've Stuck With</h2>After trying several options over the past couple of years, I landed on Bitdefender and haven't felt the need to switch since. What won me over first was how little I notice it running. It sits in the background scanning files as they open and links as they're clicked, without the constant nagging or performance drag I got used to from other tools. When I've tested it against phishing links and dodgy attachments deliberately, it's caught things before I even had the chance to open them properly. The ransomware protection is what actually sold me though. Bitdefender monitors folders I've flagged as important, like my documents and photos, and blocks unauthorised changes to them even if something slips past the initial scan. That layered approach, catching threats early but also having a backstop if something gets through, is exactly what I was missing with the free tools I used to rely on. If you're weighing up options yourself, <a href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay" target="_blank" rel="noopener" data-mce-href="https://www.bitdefender.com/en-us/consumer/?irclickid=WxSzmdWRXxyZWsOzKNx6sWZFUkrxGHQpm0ekVY0&amp;im_rewards=&amp;irgwc=1&amp;afsrc=1&amp;MPid=6273270&amp;cid=aff|c|IR|Cyber%20Jay">Bitdefender </a>is the one I'd point you towards first, and it's what I run across my own devices now. <h2>The Features That Matter More Than People Realise</h2>A few features get overlooked when people compare antivirus software, and I think that's a mistake. Webcam and microphone protection is one. It sounds dramatic until you consider how many scams now rely on voice cloning and impersonation, which is something I wrote about after nearly getting caught out by <a href="https://kellssecurity.com/blog/the-voice-clone-call-that-almost-had-me-fooled" data-mce-href="https://kellssecurity.com/blog/the-voice-clone-call-that-almost-had-me-fooled">a call that sounded exactly like a family member</a>. Anything that stops software quietly accessing a camera or mic without permission is worth having, not just as an antivirus feature but as part of a wider habit of not trusting things at face value. VPN integration is another one I didn't expect to use much but now rely on regularly, especially on public wifi. And a built-in password manager or breach monitoring feature genuinely changes how quickly you find out if an account's been compromised, rather than discovering it weeks later. These extras used to feel like bloat to me, but once I started using them properly they became as important as the core scanning itself, particularly alongside the <a href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams" data-mce-href="https://kellssecurity.com/blog/the-simple-checks-i-use-to-stop-ai-scams">basic checks I already run to catch AI scams</a> before they get anywhere near my bank details. <h2>How I Keep My Protection Up to Date Without Thinking About It</h2>The last piece of this, and the one people skip most often, is just keeping everything updated automatically rather than manually. I've set Bitdefender to update silently in the background, and I do the same with my operating system and browser, because most malware exploits gaps that were already patched months earlier. Staying current isn't glamorous, but it closes off the easiest routes in. I've also made a habit of checking my protection settings every few months rather than assuming they're still doing what I set them up to do originally. A subscription can lapse, a setting can get changed accidentally, and it's worth the two minutes it takes to confirm everything's actually active. I put a reminder in my calendar for it now, the same way I would for renewing insurance, because it's exactly the kind of thing that's easy to forget until it matters. If you want a fuller checklist for keeping your devices and accounts secure, I've put together a free <a href="https://kellssecurity.com/toolkit" data-mce-href="https://kellssecurity.com/toolkit">Safety Toolkit</a> that covers this and more. For wider guidance on protecting your devices from the UK's national authority on the subject, the <a href="https://www.ncsc.gov.uk" target="_blank" rel="noopener" data-mce-href="https://www.ncsc.gov.uk">NCSC </a>has solid advice worth reading too. None of this is complicated, and it doesn't take much time once it's set up properly. It's just the difference between hoping nothing goes wrong and actually knowing you've done what you reasonably can.I also share printable checklists and quick safety tips as pins, so follow me on <a href="https://www.pinterest.com/kellsonlinesafety/" target="_blank" rel="noopener" data-mce-href="https://www.pinterest.com/kellsonlinesafety/">Pinterest</a> too.

Is Bitdefender Worth It? The Antivirus I Actually Trust

Kells Security Solutions

I teach people around the world how to spot online scams and stay safe on the internet, explained in plain English with no jargon. I cover phishing emails, two-factor authentication, password managers, VPNs and antivirus software, written for people who are not tech experts and want to protect themselves and their families.