What makes things worse is that people reuse passwords. Once attackers crack one, they try it everywhere else: your email, your bank, your Microsoft account, your Apple ID and more. Often they fail, because most services now add a second check at login, such as a code by email or text or an authenticator app. In fact, a burst of failed attempts can trip the alarm, and the service may lock the account for a while.

The password safe

So how can you keep track of strong passwords — the kind that are not your mother’s birthday, your dog’s name or a loved one’s name?

You will need a safe.

How the safe works

A password safe can take several forms.

• One old-fashioned method is still very secure: write your passwords in a book, then lock that book in a safe or strongbox. Ideally, choose one with a solid fire rating.
• Your phone is a password safe too, as long as you unlock it with a fingerprint, Face ID or a passcode. In that case, passwords and even notes stored on the phone stay protected. Just make sure the screen locks itself automatically after a short idle time.
• Web browsers such as Chrome, Firefox, Safari and Edge all have a built-in password safe. Mostly it just auto-fills the passwords a page asks for. To keep that safe, first sign in to the browser with a master password. After that, you can view a saved password from the browser’s settings, under saved logins. You have to enter the master password again to reveal anything. You can also add your own entries by hand, as long as you give a valid-looking web address. On top of this, browsers now warn you when a saved password has been leaked. They will also generate a random password on demand, so use that feature. Finally, a browser account syncs your passwords across your computer, phone and tablet.
• I have used a password manager for years. It runs as an app on my computer, phone and tablet, with browser plug-ins that capture and fill in passwords. Because it syncs through the cloud, a login I create on my phone reaches my other devices moments later. It also warns me about weak, leaked or reused passwords. A password manager does need a strong master password — aim for at least 20 characters, mixing capitals, numbers and symbols. After that, you can unlock it with a fingerprint or Face ID. It will copy and paste passwords for you, and display them in large, clear type so you can tell letters from numbers. Like the browsers, it can create highly secure random passwords.

2-factor authentication

A few years ago, a client’s Gmail password was hacked. By the time we tried to log in and reset it, the attacker had already changed it. We never got that account back. As a result, every one of the client’s bank and government logins had to be updated, which took two days. After that, we switched on 2-factor authentication for the Gmail account. Here is how it works, and it makes an account very hard to break into:

• You will receive a text to your phone with a code you have to enter on the login page additionally to your password.
• You will receive a text to your registered email address with a code you have to enter on the login page additionally to your password.
• You use an Authenticator App which is installed on your phone and needs an initial set up like a QR code to be scanned from your institution.

Is a service offering 2-factor authentication as an option rather than requiring it? If so, I strongly recommend turning it on straight away.

If you would like help locking down your website or hosting account, get in touch with Tekwizard.