Don’t worry about getting hacked. Worry about getting socially engineered.

Engineers who want access to your e-mail or iCloud account have three ways to go about the task: They can try to persuade you to give the passwords up directly (“active engineering”); they can try to guess or reset the passwords using other information about you (“passive engineering”); or they can pretend to be someone else entirely and get account access that way (“pretexting”). Of these options, passive engineering is probably the easiest to pull off — it is, after all, just another strain of “Google stalking,” that favored technique among curious daters and other casual snoops. By gathering information from your social media accounts (as well as from public records, your employer’s Web site, your long-forgotten wedding page, and what have you), a social engineer can get a pretty good picture of what you like, where you live and what you’re generally about. That might be enough information to guess your password. If not, it’s definitely enough information to let the engineer escalate to some other type of attack.