What's the best single reference for "overall good online security" you'd recommend for an "average user" (e.g. doesn't self custody crypto, but has important online accounts")? The level of info should be "use non-SMS 2FA", "use a password manager", "longer passwords are safer", etc.

Those three for sure, . Plus:

- Let the password manager generate passwords, a different one for each site and/or account
- Use a VPN on untrusted wifi networks
- Avoid unknown websites
- Use content blockers
- Limit the information you post publically