The Warding of the Gates
In 2004 the Expansion called on XaTuring to curse the virus writers and spammers who plagued us. This working takes the other path. Instead of striking at the attackers, it closes the doors they use.
Each of the seven gates is a real act of protection, the kind of advice security professionals give everyone. Performed with intent and sealed with a spoken word, the mundane act becomes a ward. The magic is in the doing: a gate is not sealed until the work is done.
How the working goes
Open the circle with Calling the Seven Ports, or count aloud in binary to 111.
Speak the opening.
Work through the gates one at a time. When you have completed a gate's acts, speak its seal aloud and tick its box. A point of the star lights for each gate you seal.
When all seven points burn, speak the closing.
The gates need not all be sealed in one sitting. Your progress is kept in this browser only, so you can return and continue; nothing is sent anywhere. Renew the wards once a year.
The opening
Mighty XaTuring, Root Knower, Icebreaker, who knows every way into every system: show me the doors that stand open in my own. What You could enter, others could enter. Let me close them, one by one, until only I hold the keys.
The seven gates
1. The Gate of the Name
Most break-ins begin with a password stolen from one site and tried on another. A password manager remembers a long, unique password for every account so that one breach cannot open the rest.
Choose a password manager. Most browsers and phones include one, and dedicated apps are also available.
Start with your most important accounts: email, banking, and the accounts you use to sign in elsewhere.
Replace any password you have used on more than one site.
2. The Gate of the Second Key
With two-step verification (also called two-factor authentication, or 2FA), a stolen password alone is not enough. Whoever signs in must also hold a second key: a code from an app, a passkey, or a physical security key.
Turn it on for your email first, then your bank, then your other important accounts.
Prefer an authenticator app, a passkey or a security key over text-message codes when the site offers a choice.
Save the backup codes the site gives you somewhere safe.
3. The Gate of the Inbox
Your email is the master key: almost every other account can be reset through it. Whoever controls your inbox can become you everywhere else.
Make sure it has a unique password and two-step verification (gates one and two).
Check that its recovery phone number and backup email are current and belong to you.
Review the list of devices signed in to it, and sign out any you do not recognize.
4. The Gate of Renewal
Updates close the holes that attackers already know about. An unpatched device is a door left open after the lock has been publicly picked.
Turn on automatic updates for your computer, phone and tablet.
Keep your web browser up to date; most update themselves when restarted.
Restart your devices when they ask, so updates actually install.
5. The Gate of the Many Doors
Every app, browser extension and connected service is another door into your digital life. Doors you have forgotten are the ones no one is watching.
Remove apps and browser extensions you no longer use.
In your Google, Apple or Microsoft account settings, review which outside apps have access to your account, and remove those you do not need.
On your phone, check which apps can see your location, camera, microphone and contacts.
6. The Gate of Memory
A backup is protection against everything at once: ransomware, theft, a dead drive, a spilled cup. What is copied cannot be held hostage.
Back up your important files automatically, to a cloud service, an external drive, or both.
Keep at least one copy that is not always connected to your computer.
Try restoring one file, to be sure the backup actually works.
7. The Gate of Discernment
The oldest attack is a convincing message: an urgent email, a fake login page, a caller who says they are from your bank. No lock helps if you open the door yourself.
Be wary of any message that rushes you, frightens you, or asks you to sign in through a link. Go to the site directly instead.
Never share a verification code with anyone who contacts you; real companies will not ask for it.
Check whether your email address has appeared in a known data breach at Have I Been Pwned, and change any affected passwords.
The closing
When all seven gates are sealed, the star blazes complete. Speak:
Seven gates are warded. The name is unique, the second key is held, the inbox is guarded, the walls are renewed, the unused doors are shut, the memory is kept, and the eye is clear. Let the Worm swim freely here, and let all others find the gates closed. Hail XaTuring!
Count backward in binary from 111 to 0, or close the circle with the closing of the Seven Ports.
Further resources
| Resource | What it is |
|---|---|
| Secure Our World | Plain-language security guidance for the public from CISA, the U.S. Cybersecurity and Infrastructure Security Agency |
| Have I Been Pwned | Check whether your email address appears in known data breaches |
Only I hold the keys.