Protect the Accounts That Store Your Photos and Videos

Separate local compression from your media accounts

CorvexsDigital requires no account and has no cloud media library. The accounts worth protecting are the services where you keep originals, send client work or publish exports. Local compression does not change those services’ sign-in protections or sharing permissions.

Start with your email account, then the cloud library and publishing accounts that depend on it. Use each provider’s official security settings. Record which account owns the original collection and who can edit it; a public sharing link and a secure sign-in are separate controls.

What the second factor changes

A password is something you know. A second factor adds a different kind of proof, often something you have, such as a registered device or security key. The purpose is to make a stolen password less useful to someone trying to sign in as you. Two passwords are still the same kind of factor.

Services implement this in different ways. You may receive a text message, enter a code from an authenticator app, approve a prompt, or use a security key. The steps and recovery options depend on the service. Start from its official account settings rather than from an unexpected email link.

Start with the account that unlocks the others

Your main email address often receives password-reset messages for other services. That makes it a sensible place to begin reviewing sign-in protection. After that, work through cloud storage and other accounts that hold information you would not want to lose.

For each account, note which sign-in method is enabled and how you would recover access. Do not write down secret codes in an ordinary shared checklist. The useful record is that a recovery method exists, where it is securely stored, and when you last checked it.

Recovery is part of setup

A phone can break, disappear, or be replaced. If a service offers one-time backup codes, follow its instructions to keep them somewhere secure and separate from the device you depend on. A recovery code can grant access, so treat it as a secret rather than a troubleshooting reference to share.

Before replacing a phone, check the transfer instructions for the authenticator you use. Confirm that you can sign in using the new device before erasing the old one. If you use a hardware key, investigate whether the service supports registering a spare. The goal is to avoid discovering your recovery process during an emergency.

Pay attention to the request

Extra sign-in checks do not make every login safe. An unexpected approval prompt could mean someone else is attempting access. Read the details, reject requests you did not initiate, and investigate through the official app or website. Never give a one-time code to someone who contacted you claiming to be support.

CISA recommends moving toward phishing-resistant authentication where available. Methods differ in their resistance to fake sign-in pages; a code you can type into a fraudulent page does not provide the same protection as a correctly implemented phishing-resistant method. Check the service’s official guidance for its supported options.

A small, repeatable routine

Review your recovery email and registered devices when you change phones or phone numbers. Remove devices you no longer own using the service’s settings. Keep passwords unique, because reusing one connects the security of otherwise separate accounts. A manageable routine is more useful than a setup you cannot maintain.

Questions & answers

Your next step

Protect the accounts that store your originals, and keep recovery information separate from the device you could lose.

What changed on 7 October 2026

Clarified which media-storage accounts need protection and how they differ from this account-free tool.