Gadget Security Habits That Most People Skip

Software updates on phones and laptops get most of the attention, but the firmware (the built-in software) on routers, smart speakers, security cameras, and other connected devices is updated far less often — and far less automatically. Manufacturers release firmware updates specifically to patch security vulnerabilities, and an unpatched router is one of the most common entry points for home network intrusions.

Check your router's admin interface (usually accessible by typing the router's IP address into a browser) for a firmware update option, and look for a setting to enable automatic updates if available. Do the same for any smart home devices through their companion apps.

Routers, smart cameras, and many other connected devices ship with default usernames and passwords that are publicly listed in manufacturer documentation — meaning anyone who knows the device model can look them up. Changing these defaults is a fundamental step that a significant share of households still skip.

Use a unique, reasonably complex password for each device's admin interface. A password manager can store these so you don't need to memorize them. The home internet hub has further guidance on router settings worth reviewing.

Two-factor authentication (2FA) requires a second verification step — typically a code sent to your phone or generated by an authenticator app — in addition to your password. Even if someone obtains your password through a data breach or phishing attempt, 2FA blocks them from accessing your account without that second step.

Enable it on email accounts first (since email is used to reset almost everything else), then on financial accounts and any service that stores payment information. Authenticator apps are generally more secure than SMS codes, though either is significantly better than no 2FA at all.

Apps frequently request access to your microphone, camera, location, and contacts — and once granted, those permissions stay active unless you revoke them. An app you downloaded two years ago may still have location access running in the background. Both iOS and Android allow you to review permissions by app or by category (e.g., "which apps have microphone access?") in the Settings menu.

A practical rule: if an app doesn't have an obvious reason to need a permission, revoke it. A flashlight app doesn't need your contacts. A recipe app doesn't need your location. For a broader look at smartphone settings worth knowing, the smartphones hub is a useful starting point.

Most devices are set to automatically reconnect to any known Wi-Fi network and to keep Bluetooth discoverable in the background. In practice, this means your phone may silently connect to a public hotspot that shares a name with one you've used before — including ones set up deliberately to intercept traffic, a technique sometimes called an "evil twin" attack.

Disable the "auto-join" feature for public or infrequently used networks, and turn Bluetooth off when you're not actively using it. These are small friction costs with a real security benefit, especially in airports, hotels, and coffee shops.

Physical access to an unlocked device bypasses most digital protections entirely. Someone who picks up an unlocked phone can access emails, payment apps, saved passwords, and accounts in seconds — no hacking required. A PIN, password, or biometric lock (fingerprint or face recognition) is the baseline defense, but the auto-lock timeout matters just as much.

Set your screen to lock after 30 seconds to one minute of inactivity. Many people leave this at five minutes or longer, which creates a meaningful window of exposure if a device is left unattended, lost, or briefly stolen.