This is the most common and most dangerous mistake. As soon as a single service you use suffers a data breach, any email/password combination reused elsewhere becomes vulnerable to credential stuffing — bots automatically try that pair on hundreds of other sites.
The fix: a unique, randomly generated password per service. This is exactly the problem a password manager like Encryvault solves: you only ever have to remember one password, your own.
"Remind me later" on an update notification is an understandable reflex, but most software updates fix flaws that are already being actively exploited. The longer you wait, the longer the window of vulnerability stays open.
The fix: enable automatic updates everywhere possible — operating system, browser, critical applications.
A password alone, however strong, remains a single secret. If it's intercepted (keylogger, phishing, leak), that's it. 2FA adds a second barrier — a temporary code generated by your phone — that makes a stolen password useless without it.
The fix: enable 2FA on every account that offers it, starting with email, banking, and your password manager.
Phishing remains the number one entry point for account takeovers. An email impersonating your bank or a service you use, with a link to a fake login page, is all it takes to steal your credentials.
The fix: never click a login link received by email without checking the exact sender. When in doubt, type the site's address yourself into your browser.
Convenient, but in plain text — anyone with access to the device (or a poorly configured cloud backup) can read everything at a glance.
The fix: a real password manager encrypts every entry. With a Zero-Knowledge architecture, not even the software's publisher can read your secrets.
"Your mother's maiden name?", "City of birth?" — this information is often public (social media, official records) and therefore guessable.
The fix: treat security questions like extra passwords: answer with a random string, stored in your password manager alongside the account in question.
An open Wi-Fi network (café, airport, hotel) can be monitored by someone else on the same network, or be a fake access point set up to intercept traffic.
The fix: avoid entering sensitive credentials on an untrusted public Wi-Fi network, or use a trusted VPN.
A library computer, a self-service kiosk — logging out isn't a universal reflex, and the next session can inherit your access.
The fix: always log out, and regularly check the list of active devices/sessions on your important accounts to revoke anything you don't recognize.
Most services display the list of devices that have accessed your account. Almost no one ever looks at it — until the day an unknown device shows up.
The fix: get into the habit of checking this list from time to time. It's also why Encryvault sends an automatic alert as soon as a login happens from a device and location never seen before.
"I don't have anything worth stealing" is a dangerous line of reasoning: a compromised email account lets an attacker reset most of your other accounts in a cascade. It's never just "one account" — it's often the key to all the others.
The fix: treat every account, even one that seems trivial, with the same seriousness — a unique password, 2FA where possible, and vigilance about the emails you receive.
None of these fixes require any particular technical expertise: the good news is that a properly used password manager alone handles half of this list.