A decade ago, I wrote about the death of ephemeral conversation. As computers were becoming ubiquitous, some unintended changes happened, too: before computers, what we said disappeared once we had said it. Neither face-to-face conversations nor telephone conversations were routinely recorded. A permanent communication was something different and special; we called it correspondence.

The internet changed this. We now chat by text message and e-mail, on Facebook and on Instagram. These conversations — with friends, lovers, colleagues, fellow employees — all leave electronic trails. And while we know this intellectually, we have not truly internalised it. We still think of conversation as ephemeral, forgetting that we are being recorded, and what we say has the permanence of correspondence.

That our data is used by large companies for psychological manipulation — we call this advertising — is well known. So is its use by governments for law enforcement and, depending on the country, for social control. What made the news over the past year were demonstrations of how vulnerable all of this data is to hackers and the effects of having it hacked, copied and then published online. We call this doxing.

Doxing is not new, but it has become more common. It has been perpetrated against corporations, law firms, individuals, the NSA and — just this week — the CIA. It is largely harassment and not whistle-blowing, and it is not going to change anytime soon. The data in your computer and in the cloud are, and will continue to be, vulnerable to hacking and publishing online. Depending on your prominence and the details of this data, you may need some new strategies to secure your private life.

There are two basic ways hackers can get at your e-mail and private documents: one way is to guess your password. That is how hackers got their hands on personal photographs of celebrities from iCloud in 2014.

How to protect yourself from this attack is pretty obvious. First: do not choose a guessable password. This is more than not using “password1” or “QWERTY;” most easily memorisable passwords are guessable. My advice is to generate passwords you have to remember by using either the XKCD scheme or the Schneier scheme and to use large random passwords stored in a password manager for everything else.

Second, turn on two-factor authentication where you can, such as Google’s two-step verification. This adds another step besides just entering a password, such as having to type in a one-time code that is sent to your mobile phone. And third, do not reuse the same password on any sites you actually care about.

You are not done, though. Hackers have accessed accounts by exploiting the “secret question” feature and resetting the password. That was how Sarah Palin’s e-mail account was hacked in 2008. The problem with secret questions is that they are not very secret and not very random. My advice is to refuse to use those features. Type randomness into your keyboard, or choose a really random answer and store it in your password manager.

Finally, you also have to stay alert to phishing attacks, where a hacker sends you an enticing e-mail with a link that sends you to a webpage that looks almost like the expected page but which actually is not. This sort of thing can bypass two-factor authentication and is almost certainly what tricked John Podesta and Colin Powell.

The other way hackers can get at your personal stuff is by breaking into the computers the information is stored on. This is how the Russians got into the Democratic National Committee’s network and how a lone hacker got into the Panamanian law firm Mossack Fonseca. Sometimes individuals are targeted, as when China hacked Google in 2010 to access the e-mail accounts of human rights activists. Sometimes the whole network is the target, and individuals are inadvertent victims, as when thousands of Sony employees had their e-mails published by North Korea in 2014.

Protecting yourself is difficult because it often does not matter what you do. If your e-mail is stored with a service provider in the cloud, what matters is the security of that network and that provider. Most users have no control over that part of the system. The only way to truly protect yourself is to not keep your data in the cloud where someone could get to it. This is hard. We like that all of our e-mails are stored on a server somewhere and that we can instantly search it. But that convenience comes with risk. Consider deleting old e-mail, or at least downloading it and storing it offline on a portable hard drive. In fact, storing data offline is one of the best things you can do to protect it from being hacked and exposed. If it is on your computer, what matters is the security of your operating system and network, not the security of your service provider.

Consider this for files on your own computer. The more things you can move offline, the safer you will be.

E-mail, no matter how you store it, is vulnerable. If you are worried about your conversations becoming public, think about an encrypted chat program instead, such as Signal, WhatsApp or Off-the-Record Messaging. Consider using communications systems that do not save everything by default.

None of this is perfect, of course. Portable hard drives are vulnerable when you connect them to your computer. There are ways to jump air gaps and to access data on computers not connected to the internet. Communications and data files you delete may still exist in back-up systems somewhere — either yours or those of the various cloud providers you are using. And always remember that there is always another copy of any of your conversations stored with the person you are conversing with. Even with these caveats, though, these measures will make a big difference.

When secrecy is truly paramount, go back to communications systems that are still ephemeral: pick up the telephone and talk. Meet face to face. We do not yet live in a world where everything is recorded and everything is saved, but that era is coming. Enjoy the last vestiges of ephemeral conversation while you still can.

•Bruce Schneier is a security technologist and a lecturer at the Kennedy School of Government at Harvard University. His latest book is Data and Goliath: The Hidden Battles to Collect Your Data and Control Your World