Glossary
Technical terms, explained in plain language. Click any highlighted term in the modules to land here.
46 termsBackdoor
A hidden entry point into a system that bypasses normal security. Attackers install backdoors to maintain access even after the original vulnerability is patched.
Browser fingerprint
A unique profile built from your browser settings, installed fonts, screen size, and plugins. Websites use it to identify and track you, even without cookies.
Brute force
A method where an attacker tries every possible combination of characters until the correct password is found. The shorter and simpler the password, the faster it can be cracked.
Credential stuffing
An attack where stolen username and password pairs from one data breach are automatically tested on other websites, hoping people reused the same login.
Data breach
An incident where private information (passwords, emails, credit card numbers) is stolen from a company or service and often published or sold online.
Data broker
A company that collects personal information about you from various sources (apps, websites, public records) and sells it to advertisers, insurers, or other businesses.
Digital footprint
The data left by online activities, such as posts, purchases and searches. Some is public; other data is held by services. Who can access it and how long it remains vary.
DNS
The Domain Name System acts like a phone book for the internet. It translates website names (like google.com) into the numeric addresses that computers use to find each other.
Deepfake
A video, image, or audio clip generated by artificial intelligence that realistically imitates a real person. Deepfakes can make someone appear to say or do things they never did, and are increasingly used in scams and disinformation.
Encryption
A process that makes data unreadable without the right key. Protection depends on who holds the keys and whether it applies to stored data, a connection, or messages between participants.
End-to-end encryption
A type of encryption where only the sender and the receiver can read the message. Not even the company providing the service can access the content.
Evil twin
A fake Wi-Fi network that imitates a legitimate hotspot. Its operator can observe unencrypted traffic or lure you to a fake sign-in page. A valid HTTPS connection still protects its contents in transit.
Firewall
A tool that allows or blocks network connections according to rules. It helps limit exposure but does not recognize every attack or replace software updates.
Full-disk encryption
Encryption that protects data stored on a device when it is locked or powered off, depending on the system. Its protection depends on the unlock method and recovery key. It does not stop malware from reading files in an open session.
Grooming
A process where a predator builds a relationship of trust with a child or teenager online, gradually pushing boundaries to exploit them. It often starts with compliments and attention, then moves to isolation and manipulation.
Hashing
A one-way process that turns data (like a password) into a fixed-length string of characters. Unlike encryption, it cannot be reversed. Websites store hashed passwords instead of the real ones.
HTTPS/TLS
HTTPS uses TLS to encrypt traffic between your browser and a website. It protects content in transit, but the website can read what you submit. HTTPS alone does not prove that a website is trustworthy.
IP address
An address used to route internet traffic. A public IP may be shared by several devices or people. It can reveal an approximate location and contribute to tracking, but it is not a reliable personal identifier.
Lateral movement
After breaking into one system (like an email account), the technique of using that access to reach other connected systems (cloud storage, work network, financial accounts). This is how a single compromised password can lead to a full digital takeover.
Malware
Short for "malicious software." Any program designed to harm your device, steal your data, or give an attacker control over your system. Viruses, trojans, and ransomware are all types of malware.
Man-in-the-middle attack
An attack where someone secretly positions themselves between you and the website or person you are communicating with, intercepting or altering the data being exchanged.
MD5
An old hash function with practical collision attacks. It is also far too fast for password storage. Passwords need a dedicated, salted password-hashing scheme such as Argon2id.
Multi-factor authentication (MFA)
A security method that requires two or more different types of proof to verify your identity. For example: something you know (password), something you have (phone), and something you are (fingerprint).
OSINT
Open Source Intelligence. The practice of gathering information about a person or organization using publicly available sources: social media profiles, public records, company websites, forums, and leaked databases. Attackers use OSINT to prepare targeted attacks.
Passkeys
Sign-in keys tied to the real website, unlocked by a device PIN, fingerprint or face. They resist phishing and can be stored on a device, security key or synced provider. Device protection and account recovery still matter.
Passphrase
A password made of several independently chosen random words. Length and unpredictability matter: a famous quote or a published example is easy to guess. Generate your own unique phrase.
Password manager
An app that generates, stores, and fills in strong, unique passwords for every account you have. You only need to remember one master password.
Phishing
A scam where attackers send fake emails, messages, or websites that look like they come from a trusted source (your bank, a delivery service) to trick you into giving away personal information.
Pig butchering
A long-term scam where the attacker builds a fake romantic or friendly relationship over weeks or months, then convinces the victim to "invest" money in a fraudulent platform. The name comes from the idea of "fattening the pig before the slaughter."
Quishing
Phishing through QR codes. Attackers place malicious QR codes on posters, emails, or even parking meters to redirect you to fake websites that steal your information.
Ransomware
A type of malware that locks your files by encrypting them, then demands payment (a "ransom") in exchange for the key to unlock them. Paying does not guarantee you will get your files back.
Romance scam
A fraud where a scammer creates a fake online persona to build a romantic relationship with the victim, then manipulates them into sending money, sharing personal information, or laundering funds. Often conducted through dating apps or social media.
SHA-1
An old hash function with practical collision attacks. Replacing it with plain SHA-256 is not enough for password storage: use a dedicated, salted password-hashing scheme such as Argon2id.
SIM swap
An attack where a criminal convinces your phone carrier to transfer your number to a new SIM card. They can then receive your text messages, including 2FA codes, and take over your accounts.
Smishing
Phishing by text message (SMS). You receive a fake text pretending to be from your bank, a delivery service, or a government agency, with a link designed to steal your information.
Spear phishing
A targeted form of phishing where the attacker researches you personally and crafts a convincing message just for you, making it much harder to spot than generic phishing.
Shoulder surfing
The act of spying on someone's screen or keyboard to steal passwords, PINs, or other sensitive information. It happens in cafés, on public transport, at ATMs, or anywhere you type something private in view of others.
Tracking pixel
A tiny invisible image embedded in an email or web page. When it loads, it reports back to the sender that you opened the email, along with your location and device information.
Two-factor authentication (2FA)
Signing in with two different types of proof, such as a password and an authenticator app. This helps when a password is stolen, but a fake website can also steal or relay codes. Passkeys offer stronger resistance to phishing.
TOTP
Time-based One-Time Password. A method used by authenticator apps (like Google Authenticator) that generates a new 6-digit code every 30 seconds. The code is mathematically derived from a shared secret and the current time, so it works without an internet connection.
Vishing
Phishing by voice call. A scammer calls you pretending to be from your bank, tech support, or a government agency, pressuring you to share personal details or transfer money.
VPN
An encrypted tunnel from your device to a VPN provider or organization. It changes who can observe parts of your traffic. It does not make you anonymous, prevent phishing, or replace HTTPS.
Voice cloning
An AI technique that replicates a person's voice from a short audio sample (sometimes just a few seconds). Scammers use cloned voices to impersonate family members, executives, or authority figures in phone calls.
Zero-day
A security flaw in software that the developer does not know about yet. Attackers can exploit it before a fix ("patch") is available, which is why it is called "zero-day" (zero days to fix it).
Social engineering
The art of manipulating people into giving away confidential information or performing actions that compromise security. Instead of hacking a computer, the attacker hacks the human.