Passwords have a bad rap, and deservedly so: they suffer from weaknesses, both in terms of security and convenience, that make them a less-than-ideal method of authentication<\/a>. However, much of what the Internet offers is dependent on your signing up for this or that online service, and the available form of authentication almost universally happens to be the username\/password combination.<\/p>\n\n\n\n As the keys that open online accounts (not to speak of many devices), passwords are often rightly thought of as the first \u2013 alas, often the only \u2013 line of defense that protects your virtual and real assets from intruders. However, passwords don\u2019t offer much in the way of protection unless, in the first place, they\u2019re strong and unique to each device and account.<\/p>\n\n\n\n But what constitutes a strong password? A passphrase<\/em>! Done right, typical passphrases are generally both more secure and more user-friendly than typical passwords. The longer the passphrase and the more words it packs the better, with seven words providing for a solid start. With each extra character (not to mention words), the number of possible combinations rises exponentially, which makes simple brute-force password-cracking attacks far less likely to succeed, if not well-nigh impossible (assuming, of course, that the service in question does not impose limitations on password input length \u2013 something that is, sadly, still far too common).<\/p>\n\n\n\n I\u2019ll have no sympathy for the passphrase-cracker<\/strong><\/p>\n\n\n\n Another caveat is that it\u2019s better to refrain from phrases that have made it into the everyday lexicon. Entire books, famous quotes, or lyrics \u2013 sing, \u2018Pleased to meet you, hope you guess my name\u2019<\/a> as a bit of an extreme example that is not to be taken literally \u2013 already tend to be part of the fodder of password-cracking tools. The individual words should be in random order and, ideally, sprinkled with special characters and character substitution, all the while retaining a hidden meaning and memorability to its creator. For practical guidance about creating your passphrases, you may want to refer to this short video tutorial<\/a> or to this article<\/a>.<\/p>\n\n\n\n Then, of course, there is the need for each passphrase to be distinct for each account, so that a leak of one of your passphrases doesn\u2019t reverberate through your other and possibly more valuable accounts. Alas, the dangerous practice of password recycling<\/a> is ubiquitous, and attackers can exploit it hands-down with an automated technique known as \u2018credential stuffing<\/a>\u2019.<\/p>\n\n\n\n It\u2019s quite likely that you use too many online accounts to remember a distinct passphrase for each of them. In which case, it\u2019s worth considering a reputable password vault\/manager that encrypts your password storage and takes away much of the pain that password management involves. Of course, such a tool can also generate randomized and complex passwords and passphrases for you.<\/p>\n\n\n\n While then you should need to remember only one master password that, ultimately, opens all your online accounts, the pressure will be on the sturdiness and uniqueness of this one key to your digital kingdom \u2013 so it\u2019s back to the suggestions above.<\/p>\n\n\n\n I won\u2019t skip the second step<\/strong><\/p>\n\n\n\n Another trouble with passwords\/passphrases may arise when they are not only the first, but actually the only<\/em> line of defense for your account security. When that barrier crumbles \u2013 commonly through a phishing attack or by attackers somehow working out your login details \u2013 an extra authentication factor that does not rely on \u2018something you know\u2019 may very well foil your adversaries.<\/p>\n\n\n\n Two-factor authentication<\/a> (2FA), or multi-factor authentication (MFA), is an excellent way of boosting the security of your accounts, especially when coupled with hardware keys or dedicated apps, and less so with SMS-borne 2FA<\/a>. Although many online services provide 2FA options, few require its use. However, the adoption of 2FA has been on the rise and it\u2019s never been easier to jump on the practice. Regardless if its implementation, signing up for 2FA wherever you can<\/a> is well worth the little extra effort, as it can help in various scenarios, including when you never fell prey to a cyberattack compromising any of your passwords.<\/p>\n\n\n\n In fact, it\u2019s quite probable that some of your authentication details will be, or have already been, stolen and posted online or made available for sale on underground marketplaces. The source of these password leaks include the many security breaches that have blighted online services, retailers, hotel chains<\/a> and the like. Additionally, the targeted entity may have protected the users\u2019 passwords with weak hashing and salting functions, or even stored the passwords in plain text. Worse still, the service provider, let alone you, may not know until quite a while later that hackers pilfered the often poorly secured data, or purchased them on the dark web, so you had no shot at taking any ad-hoc defensive measures. Again, this is also where that extra authentication factor will usually thwart any account-takeover attempts.<\/p>\n\n\n\n In fact, go ahead and see for yourself on Have I Been Pwned?<\/a> whether any of your online accounts may have been part of a known breach. Aside from the almost 5.7 billion compromised accounts that the site indexes, it also has a cache of more than half a billion publicly leaked or stolen passwords<\/a> in clear text that have been revealed in past breaches, so you can check yours against the database, too.<\/p>\n\n\n\n![\"shut\"](\"https:\/\/www.welivesecurity.com\/wp-content\/uploads\/2019\/01\/shut-2644555_1920-1024x552.jpg\")
<\/a><\/figure>\n\n\n\n
![\"Password](\"https:\/\/www.welivesecurity.com\/wp-content\/uploads\/2014\/01\/passwordsecurity2000-1024x795.jpg\")
<\/a><\/figure>\n\n\n\n