Accounts: passwords, passkeys and two-factor authentication

Most break-ins do not start with a dramatic exploit; they start with a password that was reused, guessed, or handed over by mistake. Accounts are where this course begins because they are usually the actual target, whatever device or network they are reached through.

What makes a password strong, according to NIST

The US National Institute of Standards and Technology’s guidance on passwords (SP 800-63B) has moved away from the old advice of forced complexity and frequent changes. It states that verifiers ‘SHOULD NOT impose other composition rules (e.g., requiring mixtures of different character types or prohibiting consecutively repeated characters)’, and separately that they ‘SHOULD NOT require memorized secrets to be changed arbitrarily (e.g., periodically)’, changing them instead only when there is evidence of compromise. What NIST does require is length: passwords you choose yourself ‘SHALL be at least 8 characters’, and services should check new passwords against lists of ones already known to be compromised.

EFF’s guide reaches a similar place from the human side: length beats forced complexity, because ‘the longer and more random the password, the harder it is for both computers and humans to guess.’ For the handful of passwords you must remember, such as your device password or your password manager’s master password, EFF recommends a multi-word passphrase, suggesting ‘a minimum of six words’ chosen at random rather than picked to feel memorable.

Why a password manager, not memory

The only way to have a different, long, random password for every account without writing them down insecurely is to stop memorizing them. EFF describes a password manager as a tool that ‘creates and stores unique passwords for you, so you can use many different passwords on different sites and services without having to memorize them.’ One reused password, once leaked from any one of the sites that had it, otherwise becomes a key to every other account that shares it.

Passkeys: removing the shared secret entirely

Where a site or app supports it, a passkey removes the password from the equation. Apple describes passkeys as ‘a replacement for passwords that are designed to provide websites and apps a passwordless sign-in experience that is both more convenient and more secure’, built on a key pair where ‘the server never learns what the private key is’ and ‘no shared secret is transmitted.’ Because there is no shared secret to steal or hand over on a fake login page, passkeys are, in Apple’s words, ‘highly phishing-resistant’ in a way a typed password can never fully be.

Two-factor authentication on everything that offers it

Wherever passkeys are not yet available, two-factor authentication is the next-best layer: a second proof, beyond the password, before an account can be accessed. Apple explains that its version is ‘designed to make sure that you’re the only one who can access your account — even if someone else knows your password’, requiring both the password and ‘the six-digit verification code that’s automatically displayed on your trusted devices or sent to your trusted phone number.’ EFF adds a practical refinement: prefer an authenticator app or a hardware key over a text-message code where you have the choice, since, as the guide notes, ‘it’s easier for an attacker to redirect these codes to their own phone than it is to bypass the authenticator.’

• Use a password manager so every account gets a unique, long password without you memorizing them.
• Turn on a passkey wherever a service offers one.
• Turn on two-factor authentication everywhere it exists, preferring an authenticator app or hardware key over text messages.
• Give fictional answers to security questions: EFF warns that honest answers are often ‘publicly discoverable facts that a determined adversary can easily find.’