Online Safety Myths That Give People a False Sense of Security

Incognito mode was designed to keep browsing history off a shared or personal device — useful if you're shopping for a gift on a family computer. It was never built to hide who you are online. Your ISP still logs the sites you connect to, and websites still collect your IP address and can track behavior through cookies set during that session. If true anonymity is a goal, a VPN adds a layer of traffic encryption, though even that has limits — see what VPNs actually protect for a realistic picture.

This myth has roots in an era when Windows was dominant and attackers focused their efforts there. As Apple's market share has grown, so has attacker interest. Documented macOS malware families — including adware, spyware, and ransomware — exist and circulate in the wild. iOS is more locked down due to its app review process, but malicious apps have slipped through, and browser-based threats apply to any device. Keeping your operating system and apps updated, and downloading software only from trusted sources, applies regardless of which platform you use.

HTTPS encryption protects data in transit — it makes it harder for someone on the same network to intercept what you're sending. But phishing sites and fraudulent storefronts can and do use HTTPS. Obtaining an TLS certificate (what creates the padlock) is free and takes minutes. Our article on what the HTTPS padlock actually protects explains exactly where this encryption helps and where it leaves gaps. Always evaluate whether a site is trustworthy independently of its padlock status.

Even a complex, unique password can end up in attacker hands if the service storing it suffers a breach. Once credentials are leaked, they're often sold or shared in bulk. Two-factor authentication (2FA) — where a second verification step is required at login — significantly reduces the risk even when a password is compromised. Services like banking, email, and cloud storage nearly all offer 2FA. Enabling it takes a few minutes and is one of the highest-impact steps an everyday user can take.

Traditional antivirus works largely by recognizing known threat signatures — patterns previously identified as malicious. Zero-day exploits (attacks using vulnerabilities that haven't been publicly disclosed yet) and novel malware strains may not be in those databases. Modern security also requires caution around links and attachments, keeping software updated, using strong authentication, and being aware of social engineering tactics. Antivirus is worth running, but treating it as a complete solution creates overconfidence in exactly the scenarios where vigilance matters most.

Ransomware is a visible exception — it announces itself. But many other types of compromise, including account takeovers, data-harvesting malware, and credential theft, are deliberately stealthy. An attacker sitting inside an email account can monitor communications, reset passwords to other services, or exfiltrate data without triggering obvious alarms. Regularly reviewing account activity, setting up login alerts where available, and periodically checking whether your email appears in known breach databases are practical habits that don't require technical expertise.