What makes things worse is that people tend to REUSE passwords. Once one password has been hacked, the hacker has full access to everything else – and I assure you, they will try out your email, your bank, your club, your Microsoft account or your Apple ID and, and, and. They may fail, as now there is mostly a secondary authentication necessary like receiving an email, a text or using a number crunching app on your phone when you are logging in. Though multiple hack attempts like this can easily block your account as the suspicious activity may alert the institution to shut your account down at least temporarily.

The password safe

So what can you do to remember your passwords even if they are not your mothers birthday, your dog’s name or the name of a loved one?

You will need a safe.

How the safe works

A safe for passwords can have different appearances.

• A very old fashioned and VERY secure method is to write down passwords in a book and then store that book in a safe or strongbox. Make sure it has a good fire resistance survival time.
• Your phone is a password safe in case you are using a Fingerprint ID, a Face ID or at least a password protection to unlock your phone. Then your passwords within your phone, even notes with passwords are secure. Just make sure the phone locks the screen automatically after some time of not being used.
• Internet Browsers like Chrome, Firefox, Safari, Edge have all built in password safes. These are mostly used to auto fill any passwords required on a web page. In order for that to be safe, you will need an initial log in to that browser with a master password. Then, if you want to see one of the passwords, you have to go to the browser’s preferences and look for the saved logins. There you will need to enter the master password again to see the stored content. You may even enter your own passwords here as long as you enter a valid web address (which can be a non existing fantasy address). Browsers now will show a warning if passwords have been found to have been compromised. Most browser will help you when filling out a required password by generating a random password on demand – use it! To synchronise passwords between devices like computer, phones and tablets they are able to synchronise the passwords for you by using an user account.
• I am using a Password Manager for many years now. It is an app on my computer, my phone and tablet and it has plug-ins on my browsers to capture and fill in passwords. The Password Manager will synchronise passwords over the cloud to all devices, so a login created on my phone is short time later available on my computer and tablet. Password managers will warn you on compromised passwords and if you use the same password multiple times. Password managers need a strong master password (think on something at least 20 characters long with capitals, numbers and special characters). Once established the managers may be unlocked with a fingerprint or Face ID. A password manager will allow you to copy and paste passwords and to display them in large letters and in a distinct way so that you can identify numbers from letters. They all can create highly secure random passwords.

2-factor-authentication

I had a client a few years ago where the gmail account’s password had been hacked. As we tried to login and change the password the hacker had already changed the password himself – we never got that account back. All my client’s bank, government logins and other numerous logins had to be updated and it was a matter of two days to accomplish this. After this we activated the 2-factor-authentication at Google for Gmail. That’s how it works below, and it makes it nearly impossible to compromise your accounts:

• You will receive a text to your phone with a code you have to enter on the login page additionally to your password.
• You will receive a text to your registered email address with a code you have to enter on the login page additionally to your password.
• You use an Authenticator App which is installed on your phone and needs an initial set up like a QR code to be scanned from your institution.

If your institution has not yet forced you to use 2-factor-authentication, but is offering it as an option, the I highly recommend to make the switch ASAP.