DevicesOne Password Each
Use a different strong passphrase for every account, kept in a password manager.
When one website is breached, attackers try the same email and password everywhere else. If you've reused it, one leak becomes many. Remembering dozens of unique passwords is impossible, so don't: let a password manager remember them, and keep one strong passphrase for the manager itself.
How to use it
- Use the password manager your organisation provides, or a reputable one for personal accounts.
- Create a long passphrase for the manager, such as three or four random words, and never use it anywhere else.
- Let the manager generate a unique password for every other account.
- Start with the accounts that matter most: work email, banking, personal email and anything that resets other accounts.
- Turn on a second factor everywhere you can. See Phishing-Resistant Sign-In.
Example
A hypothetical teaching assistant learns that a shopping site she used was breached. Because every account has its own password, she changes one password and nothing else is affected.
Watch out
- Passwords on sticky notes or in a plain document defeat the point.
- If you think a password has leaked, change it from a trusted device straight away, as in I Clicked, Now What.
For credentials in code and systems, see Secrets Out Of Code.