What You Should Know About Passwords

Reusing one password

If you currently have one password that you use everywhere, or you use a master password with some modification for different sites, for example "This-!s-my-master-Passphrase" and, for Google, "This-!s-my-master-Passphrase-Google," For your sake, STOP. While cyber security has improved over the years, there are still many sites that will leak your "master" password, most likely unintentionally. It will probably be some site you have only logged into once, but that will expose all your other sensitive accounts. If you take away one thing from this, it should be: start using the default password manager of your browser or OS. This way you still only have to remember one password, but now all other sites will have a unique, strong password.

Using a Password Manager

If you store important passwords, like your online bank account password, in a password manager, you should be very careful about how you use it. If you are, like I was, copying and pasting passwords from the password manager, you should be aware of a potential security risk. If you copy and paste a password, it is stored in your clipboard. The clipboard is a shared resource and can be easily accessed by other applications, browser extensions, etc. If one of these is compromised, then any password you copy this way can be stolen. My recommendation is to use strong word passwords that you can view in the password manager and then type into your sensitive accounts. For everything else, you can use the auto-fill service provided by the password manager. Why not use auto-fill for sensitive accounts? Because it adds another layer of exposure, and any code can have bugs or vulnerabilities that can be exploited.

A word about two-factor authentication (2FA)

The idea behind 2FA is that you have something you know, your password, and something you have, like a phone with an authenticator app or a hardware key. This greatly reduces the risk associated with a compromised password. But it is only as strong as the recovery method. If you can use your email to recover a lost password or reset 2FA, then all of the security risk is essentially on your email account and how secure it is. So always pay attention to how a potential attacker could abuse the recovery method.

What are strong passwords?

These are usually 4-6 words with a special character between each word. For example, "This1,Password3,Is2,Very9,Strong4". They are easy to enter and sometimes to remember because length is better than complexity. So "This1,Password3,Is2,Very9,Strong4" is better than "f34iAsfsEhQv,e#".

What are passkeys?

A passkey is usually a physical device that looks like a USB key and covers both parts of 2FA. It is something you have, the physical device, and something you know, the PIN or biometrics stored on the device when you set it up. Passkeys are the best way to avoid remembering strong passwords. Most of the big players have already adopted passkeys, so you should consider switching to them wherever they become available.

What to do about sites that don't support passkeys?

If the site doesn't store any sensitive information, like payment or personal information, then you can use a strong password stored in a password manager. But if it does store information that you consider critical to your security, then do not use a password manager because it is still a single point of failure. In that case, I recommend generating a strong password and encrypting it with a passkey. This way you can store the encrypted password on your devices and in the cloud and decrypt it with your passkey when you need it. This is why I created **Secretum**. It is completely free and open source. But don't blindly trust me. You can read the code and launch it locally or host it yourself.