Passwords: “If Security Was Simple, It Wouldn’t Be Secure”

Why Reused Passwords Are Risky

Nobody wakes up in the morning excited about passwords. Nobody pours a cup of coffee and says, “You know what would make today better? Another account with another password requirement.” But those passwords protect your email, your money, your pictures, and a whole lot of information you probably don’t want handed to a stranger. They deserve more thought than your dog’s name followed by your birth year.

I hear it all the time. “I use the same password for everything because I can remember it.” I understand the convenience. But if one website loses that password in a breach, somebody can try it against your other accounts. Your shopping account, your email, and your bank might all have different front doors, but you’ve given them the same key. Using a different password for every account helps keep one company’s security problem from becoming a problem everywhere else. (pages.nist.gov)

Changing the number at the end doesn’t solve the problem, either. “StevePassword1” and “StevePassword2” are cousins. We need passwords that aren’t related.

What Makes a Strong Password?

Length matters. A short password doesn’t become wonderful because you replaced an “a” with an “@” and stuck an exclamation point on the end. Those tricks are predictable. NIST identifies length as the most important part of a good password and recommends using a password manager to create strong, unique passwords. (nist.gov)

My practical advice is to let your password manager generate a random password of 16 to 20 characters or more whenever the website allows it. Let it handle the letters, numbers, and symbols. You don’t need to memorize something that looks like Steve fell asleep on the keyboard. For a password you do need to remember, such as the master password for your password manager, use a long passphrase made from several randomly selected, unrelated words. Avoid famous quotations, song lyrics, family names, or anything somebody could learn from your Facebook page. Length helps, but a long password that everybody can guess still has a problem.

Why Use a Password Manager?

Now comes the obvious question: “How am I supposed to remember a different password for every account?” You aren’t. That’s what a password manager is for.

A password manager stores your logins in an encrypted vault and helps you create and fill in passwords. You protect the vault carefully, and it handles the pile of passwords you could never reasonably keep in your head. A password manager makes it practical to use a different, randomly generated password for every account. That way, a breach at one website is less likely to put your other accounts at risk.

Password Manager Options

Bitwarden

I use Bitwarden, and I like it enough to pay for Premium to support them. It costs $19.80 a year, and I’m happy to pay it. But you don’t have to pay to get started. The free plan includes unlimited password storage, access across your devices, and a password generator. That gives you plenty to start building better habits. (bitwarden.com, bitwarden.com)

LastPass

LastPass is another name you’ve probably heard. However, its security history deserves consideration: the company disclosed that attackers stole backups of customer vault data during its 2022 incident. Password fields were encrypted, but stolen encrypted vaults are still a serious matter.

Personally, Bitwarden is my choice. (blog.lastpass.com)

Apple Passwords and iCloud Keychain

If you use an iPhone, Apple’s Passwords app is also an option worth knowing about. With iCloud Passwords & Keychain, it can keep your passwords available across supported devices.

Apple says that information is protected with end-to-end encryption, meaning Apple cannot read it. You may already have a useful password tool sitting on your phone. (support.apple.com, apple.com)

Protect the Password Manager

Whichever manager you choose, protect it carefully. Give it a strong, unique master password where required. Enable two-factor authentication. Set it to lock when you’re finished, and keep recovery information somewhere safe that you can reach even if you’re locked out of the vault. That last part matters. Recovery instructions stored only inside the account you can’t open aren’t going to do you much good.

Add a Second Layer of Protection

Passwords are only part of the picture. Check out our other Hints and Tips posts on two-factor authentication and choosing an authenticator. A strong password and a second layer of protection belong together. Even if somebody obtains your password, two-factor authentication can make it much harder for them to access the account.

A Practical Action Plan

You don’t have to fix every account tonight. Start with your email, because it often holds the password reset links for everything else. Then work through your financial accounts, your main Apple, Google, or Microsoft account, and the rest as you go. Replace reused passwords with unique ones and turn on two-factor authentication wherever it’s available.

A simple order of attack is:

1. Choose a password manager.

2. Create a strong master password or passphrase.

3. Enable two-factor authentication for the password manager.

4. Secure your email account first.

5. Update your financial and primary technology accounts.

6. Replace reused passwords with unique, randomly generated ones.

7. Turn on two-factor authentication for important accounts.

8. Store recovery information somewhere safe and accessible.

“If security was simple, it wouldn’t be secure” captures how frustrating this stuff can feel. But good tools can make secure habits easier. The goal is to make things harder for somebody trying to break in while keeping them manageable for you. Steve, if you can remember every password you hav