The Solo’s Guide to Operational Security

How to stay safe without turning your life into a spy movie.

Picture This

A YouTuber, an influencer, and an IT guy walk into a bar. The topic is simple: how to stay safe online.

• The YouTuber says: “Use a strong password for all your social media accounts.”
• The influencer says: “Use two-factor authentication on top of a strong password for all your accounts.”
• The IT guy says: “Use a strong password with MFA for all your accounts.”

The bartender nods, then asks the only question that matters:

“Okay… but what is a strong password? And can it be something I can actually remember?”

The IT guy answers:

“Use a password generator. Even browsers now generate passwords that won’t be brute-forced in your lifetime.”

The bartender asks the uncomfortable follow-up:

“So I need a password to protect my password generator, which protects all my other passwords. If I lose that one, isn’t that a single point of failure?”

The IT guy shrugs:

“Yes. But that’s your fault.”

Nobody is wrong. Nobody is fully right.

Most security advice is correct inside its own mental model, but it skips reality: humans forget, humans reuse patterns, humans get locked out, and humans choose convenience until failure forces change.

The Real Question

How do you create passwords for your phone and accounts that are strong, random-looking, and memorable, without relying on one fragile master secret that can ruin your life if you lose it?

The answer is not “be more disciplined.”
It is not “use five apps and a YubiKey.”
It is definitely not “memorize a random thirty-character string.”

The answer is mathematical.

But before that, we need basic OPSEC hygiene.

Who This Guide Is For

Most OPSEC advice online falls into two buckets.

Paranoid-mode OPSEC

Assumes nation-state adversaries, targeted malware, coercion, and surveillance as normal conditions.

Normal-person OPSEC

Assumes phishing, credential stuffing, SIM swaps, shady apps, data brokers, and opportunistic theft.

The problem is people mix both and hand out a generic checklist:

“Use Tor, use a VPN, get GrapheneOS, remove metadata.”

That advice can be valid. It is just not universally relevant.

This guide targets the second group: people who want to be meaningfully safer without operating like they are hunted by an APT every day.

If you are high-risk, this still helps. You will just add more layers later. This guide is not anti-paranoia. It is anti-confusion.

OPSEC Hygiene

The boring part that actually works.

Before passwords, anchor this:

Most “hacking” today is not hacking. It is login.

That one line explains why smart people still get burned. Usually it is not a movie exploit. It is account access gained by phishing, reuse, weak recovery paths, or one old leak.

Real Threats Most People Face

• Phishing
• Password reuse and credential dumps
• Weak or guessable passwords
• SMS-based two-factor attacks (SIM swaps)
• Malicious apps and bad permission hygiene
• Lost or stolen phones
• Account recovery paths weaker than the account itself

Notice what is missing: zero-days, cinematic hackers, hoodie mythology.

Just repeatable failure modes, at scale.

What Improves Safety Quickly

• Use a password manager
• Use MFA (prefer authenticator apps or passkeys over SMS)
• Make recovery harder than login where possible
• Lock down email, because email is the skeleton key
• Keep your phone patched, because your phone is your identity now

Do those five consistently and you are already ahead of most people who claim to care about security.

Now we can talk about the hard part: human memory versus strong passwords.

Chapter 1: Cognitive Encryption

How to store strong passwords in your head without storing them in your head.

Most password advice assumes one of two extremes:

• memorize a few weak passwords you can recall under stress, or
• generate high-entropy passwords you cannot remember and fully outsource memory to a password manager.

Both approaches can work. Both fail in predictable ways.

Cognitive encryption sits in the middle. It is not security magic and it is not a replacement for a password manager. It is a method for turning human memory into a cryptographic asset without asking your brain to behave like storage hardware.

The Idea

Instead of memorizing the final password you type, memorize:

1. A base secret you never type
2. A transformation rule you can apply quickly

What you type is the output of the rule, not the base secret itself.

A captured password can still expose one account, but it does not automatically expose your whole mental vault.

Think in layers:

• Base phrase: never typed, only remembered
• Base password/PIN: derived privately from that phrase
• Encryption step: a simple mental transform
• Final password: what you actually type

The goal is not academic unbreakability. The goal is reliable execution under pressure while forcing ambiguity for observers.

The Mod-Ten Method

Simple under stress, structured enough to scale.

Step 1: Build a Base PIN That Only You Can Reconstruct

You want something regenerable, not something fragile that must be remembered exactly.

Use private anchors. Example: a book meaningful to you, plus internal coordinates that are emotionally sticky.

For a fictional example:

• favorite chapter: 12
• page you remember: 347
• another anchor page: 89

Base PIN:

12 347 89 -> 1234789

This is not random, but it is reproducible and private.

Step 2: Choose a Reproducible Value of k

A fixed k (like 3) works, but repeated outputs can create patterns. Better: make k service-specific while keeping it easy.

Option A: Secret Nickname Method

Assign each service a private nickname.

Example:

• bank -> “Harbor”
• email -> “Archive”
• government portal -> “Gate”

Then derive k from a stable trait (letter count, syllables, or private rule).

Fictional example:

• “Harbor” has 6 letters -> k = 6

Option B: Day-of-Week Method (Use Carefully)

Dynamic k can help, but can also cause self-lockout if you forget your own rule.

Safer form:

• weekday_index (Mon=1 … Sun=7)
• plus private offset s
• mod 10

Formula:

k = (weekday_index + s) mod 10

Use this only if you can execute it consistently.

Option C: Two-Factor-in-the-Head Method

This is usually the strongest practical option.

• Choose a fixed secret digit s
• Derive service digit d privately
• Compute:

k = (d + s) mod 10

Even if d is guessed, k is still hidden behind s.

Step 3: Apply the Transform

For each digit:

new_digit = (digit + k) mod 10

Example:

• 9 + 3 -> 2
• 7 + 3 -> 0

Fictional end-to-end run:

Base PIN: 1234789
Service-specific k = 6

• 1 -> 7
• 2 -> 8
• 3 -> 9
• 4 -> 0
• 7 -> 3
• 8 -> 4
• 9 -> 5

Final output:

7890345

That is what you type.

Why This Helps

1. Typed Output Does Not Reveal the Base

Seeing 7890345 does not automatically expose your private anchors.

2. It Scales Without Fragile Lists

If you can reconstruct your base and your k rule, you can generate multiple unique outputs without storing many secrets.

3. It Contains Damage

One breach should be one room on fire, not the whole building.

Caveats That Matter

Cognitive encryption is useful only if you are honest about limits.

Caveat 1: Keyloggers Still Compromise Accounts

If malware captures final output, that account is exposed.

This method helps against cascade compromise, not active endpoint compromise.

You still need:

• MFA
• device hygiene
• layered defense beyond passwords

Caveat 2: Base + Output Can Expose k

If an attacker gets both your base and final output, k can be derived.

Never type or publicly demonstrate your real base method.

Caveat 3: Predictable Anchors Are Weak Anchors

If anchors come from public identity data (birth year, phone number, public habits), others can reproduce your system.

Caveat 4: Complexity Fails at 03:00

If your system is too complex to run while tired or stressed, you will bypass it. Then the bypass becomes your real security model.

Keep it executable.

Practical Deployment

• Use a password manager for the long tail
• Use cognitive encryption for a small set of high-value secrets:
  • phone unlock
  • primary email
  • password manager itself
  • any account whose loss would seriously damage your life

Cognitive encryption is not for everything.