Two hours that decide whether your accounts survive a breach
Why the order in which you fix your accounts matters more than the number of fixes, and what a real recovery looks like after a credential dump.
Perth, Western Australia · IT student · Security
Security advice written for people who aren't security people.
I'm Wenyuan LYU. I study IT and I'm specialising in cybersecurity. This site is where I keep short, tested field notes on the security decisions ordinary people are asked to make — and almost never get explained properly.
Updated 23 October 2026
What this site is
Most security writing is split between two audiences that never meet. One side is vendors and researchers, whose material assumes you already know the acronyms. The other side is awareness posters, which tell you to "stay safe online" without telling you what staying safe actually looks like on a Tuesday night when a login page looks slightly wrong.
This site sits in the gap. Each note takes one concrete decision — whether to use a password manager, how to read a suspicious login page, what a digital footprint actually is — and works it through in plain language, with the reasoning shown. Where a claim depends on evidence, I say what the evidence is.
Recent notes
Phishing is a design problem, not a user problem
Clicking the wrong link is treated as a personal failing. The evidence points somewhere less comfortable — at the interfaces we are asked to trust.
Your footprint is a database you didn't mean to build
Everything you publish is aggregated by something. The useful question is not "how do I delete it" but "who is holding it, and what do they do with it".
Resources I actually use
A short, credited list of the tools and public guidance I check against, kept deliberately small so it stays useful.
Who I am
I'm an IT student at Curtin University in Perth, working towards a career in cybersecurity. My interest is not in breaking systems but in the friction between good security practice and real human behaviour: the password reused because it is easier, the update deferred because it arrived at a bad moment, the public profile that quietly becomes a data source.
This site is my attempt to practise the part of the job that is hardest to teach — explaining a technical decision to someone who has no reason to care about the technology, only about the consequence. More about this project →
Elsewhere
This site is the centre of my web presence. The three places below are where the same interests are worked out in public, and each of them links back here.
Mastodon
@wlyu333@infosec.exchange
Short posts, boosts and replies on security practice and the public conversation around it.
Open profile →
Dev.to
wlyu333
Longer technical write-ups, where a note outgrows a single post and needs code and references.
Open profile →
LinkedIn
Wenyuan LYU
The professional record: study, skills and what I am working towards.
Open profile →