Passwords and Authentication

A threat model sorts out who is likely to come after an account and what that person wants. Across almost every threat model from the last lesson, from a nosy acquaintance to a criminal crew running stolen data at scale, the single highest-value move is the same: fixing how accounts are locked. The lock is the password and whatever sits behind it. Most people set that lock once and never touch it again, and the attacker is counting on exactly that.

One breach becomes every account

Password reuse is the number-one way ordinary people get compromised, and the mechanism repays a close look. When a website is breached, the attacker walks off with a list of email addresses and passwords. That list gets copied, traded, and sold, and eventually it reaches automated tools. The technique those tools run is credential stuffing: take an email and password that leaked from one site, then replay the pair against hundreds of others, banks, inboxes, shopping accounts, streaming, and watch for where the same pair still works.

The attacker is not sitting at a keyboard guessing. The replay is automated across millions of pairs, and it costs almost nothing to run. Reuse is what makes it pay off. One forgotten forum from a decade ago, breached and leaked, becomes the key to a bank login if the same password guarded both. The forum did not have to be important. It only had to share a password with something that is.

Checking exposure is free. Have I Been Pwned, at haveibeenpwned.com, is a service that aggregates known public breaches. Entering an email address returns the list of breaches that included it, so the damage is at least visible. The same site runs Pwned Passwords, which reports whether a specific password already appears in breach corpora; it uses a math trick called k-anonymity so the full password never leaves the device.

What Have I Been Pwned does not do matters just as much. A clean result is not a clean bill of health. It only knows about breaches that have been reported and loaded, so a result of not found means the address has not been seen in the public sets, not that it is safe. It also cannot fix anything. It reports exposure; the repair is still changing the password and turning on a second factor.

The fix is a password manager

The instinct after a scare is to invent a cleverer password. That does not scale. A password strong enough to resist cracking is too long to remember, and a password easy to remember gets reused, which is the original problem. A password manager breaks the tradeoff. It generates a long, random password for every account, stores them all encrypted behind one master password, and fills them in on request. The person memorizes exactly one secret. The manager handles the rest, and every account gets a different lock.

Two free, open-source options cover almost everyone:

• Bitwarden. The free tier is genuinely complete: unlimited passwords, unlimited devices, and sync across phone, browser, and desktop. The code is open source and has been independently audited. For most people this is the plain choice.
• KeePassXC. Fully offline. It keeps an encrypted vault file on the device, in the KDBX format, with no server involved unless that file is synced by hand. This suits anyone who wants no company holding the vault at all.

The browser has a built-in version of this. Saving passwords in the browser is far better than reuse and worth turning on for anyone not ready for a dedicated tool. A standalone manager still wins on portability across browsers and on stronger export and sharing controls, so the honest ranking runs: a manager is best, the browser is a solid second, and reuse is the floor nobody should be standing on.

Both managers do more than store secrets. Each one carries a health report that flags reused passwords, weak ones, and any that have turned up in a known breach, checked against the same Pwned Passwords data from the first section. That report turns the abstract advice of this lesson into a concrete list of accounts to fix, worst first.

A manager does not make the account bulletproof. The master password becomes the one secret that guards everything, so it has to be strong and unique, ideally a long passphrase of several unrelated words rather than a short scramble. If the master password is weak or reused elsewhere, the vault turns into the weak point instead of the fix. No cloud service holds that master password in a form it can read, which is the point, and also the reason a forgotten master password cannot simply be mailed back.

A second factor, weakest to strongest

A password can be phished, cracked, or leaked. A second factor means the attacker who has the password still cannot get in, because logging in now needs something else too. The options form a ladder, and each rung is stronger than the last.

• SMS codes. A code texted to the phone. This is the weakest second factor, for two reasons. The first is SIM swapping: the attacker persuades the phone carrier to move the number onto a SIM card the attacker controls, then receives the codes directly. The second is that a texted code can be phished in real time, typed into a fake page and relayed within seconds. SMS is still worth using wherever nothing better is offered.
• Authenticator apps. Apps such as Aegis, which is open source on Android, generate a rotating six-digit code on the phone itself, offline, changing every thirty seconds. There is no phone number to hijack, so SIM swapping stops working. A code typed into a convincing fake page can still be relayed, so this rung is stronger but not phishing-proof.
• Hardware security keys. A physical key, such as a YubiKey or an open-source equivalent, that plugs in or taps by NFC. The key checks the real web address before it answers, so it refuses to respond to a lookalike domain. That makes it phishing-resistant in a way codes are not.
• Passkeys. A newer standard built on public-key cryptography. The phone or a hardware key holds a private key, the site keeps the matching public key, and there is no code to type and nothing for a fake page to steal. Passkeys are the direction most large sites are heading.

The rule underneath the ladder is short: any second factor beats none. An account with SMS codes is far harder to take over than one with a password alone. Climbing to an app, a key, or a passkey is about matching effort to how much the account is worth, not about SMS being worthless.

What to secure first

Accounts are not equal, so effort should not be spread evenly. Two accounts sit above the rest.

Email is the master key. Password resets for nearly everything else are delivered to the inbox, so an attacker who controls the email can walk down the list, resetting the bank, the shopping accounts, and the social profiles one at a time. Hardening the email protects every account that resets through it.

The password manager vault is the other crown jewel, because it holds every other lock at once. A strong master passphrase and a second factor on the manager guard the whole set together.

That gives a clear order of operations:

1. The password manager: a strong, unique master passphrase and its own second factor.
2. The primary email: a unique password from the manager, the strongest second factor on offer, and recovery codes saved.
3. Money and identity: banks, payment apps, and anything tax or government related.
4. Everything else, worked outward as time allows.

Effort should track risk. A throwaway login for a recipe site does not need a hardware key. The email and the manager do, because every other account leans on them.

Even a perfect lock opens for whoever holds the key, and the fastest way for an attacker to get the key is to ask for it while posing as someone trusted. A manager that quietly refuses to autofill on a lookalike domain is one defense against that trick. The next lesson takes on the rest: how scams and phishing get people to hand over the code, the password, or the click, and how to catch the tell before it lands.