Passwords without the pain

Cartoon

Greg is at work. He has one password for everything: email, online stores, the bank. At least he won’t forget it: his name and birth year.

Greg: What? I didn’t sign in anywhere!

Six months ago, crooks broke into an online store where Greg once bought a drill. The passwords from it leaked. Crooks try them on email, banks and social media — and somewhere they work.

Max: Greg, one password for everything is like one key for your house, your car and your cabin. Lose it once, and everything is open.

Max: A strong password is long, not complicated. Four random words are easy to remember and almost impossible to guess. And every website gets its own.

Max: And so you don’t have to keep it all in your head, there’s a password keeper. It’s already built into your phone and your web browser: it makes up a password and fills it in for you. You only remember one — the one for the keeper itself.

Max: You don’t have to change passwords every month. Change one right away if it leaked or you got a message about someone else signing in. Like now.

Greg: I changed my email and bank passwords and signed out of every device that isn’t mine. Now every website has its own key.

The most important one is your email password: through your email, someone can reset all your other passwords.

Exercise: safe or not?

Here are six password habits. For each one, decide: is it dangerous or not?

• Habit: «The same password for email, the bank and online stores.» — Dangerous. If it leaks from one place, everything opens. Every website should have its own password.
• Password: «Kate1987» — Dangerous. A name and birth year are the first things crooks try. They’re easy to find on social media.
• Password: «lemon-trolley-guitar-cloud» — Safe. Long, made of random words and used for just one website. A good password.
• Habit: «The bank password is written on a sticky note stuck to the computer screen at work.» — Dangerous. Anyone who walks up to the desk will see it. A password keeper on your phone is better.
• Habit: «The password keeper on the phone makes up and remembers the passwords. You only remember one, for the keeper.» — Safe. That’s the way to do it. The passwords are different and long, and you don’t have to fill your head with them.
• Call: "email support": «For a security check, please tell me your email password.» — Dangerous. No support team needs your password. You never tell it to anyone.

What to remember

• One password for everything is dangerous: if it leaks from one place, everything opens.
• A strong password is long: a few random words.
• A password keeper on your phone will make up and remember passwords for you.
• Change a password right away if it leaked or you got a message about someone else signing in.

Questions

Why is it dangerous to have one password for everything?

• It’s easy to forget
• If it leaks from one website, crooks can get in everywhere
• Websites don’t allow it

Stolen passwords get tried on email and banks. A separate password for each website protects you from that.

Which password is stronger?

• Greg1972
• Q7#k!
• blue-teapot-flies-to-the-lake

Length matters more than symbols. A few random words are almost impossible to guess.

What is a password keeper?

• A program on your phone that makes up and remembers passwords for you
• A notebook full of passwords
• A service you tell your password to over the phone

It’s already built into your phone and web browser. You only need to remember one password.

When do you definitely need to change a password?

• Every week
• Never
• Right away, if it leaked or you got a message about someone else signing in

Changing passwords for no reason does little. But after a leak, change it immediately.