Passwords
Password Manager
Bitwarden, a free and open-source password manager. Unlimited passwords and devices.
Creating a good password
- Let your password manager generate a password for you and don’t bother remembering the password. For example,
XQ!%AhCx64BkHK - Prefer to use a passphrase over passwords. Passphrases are passwords which are made up of a combination of words. For example,
Absentee2-Unused-Reoccur. These are much easier to remember than autogenerated passwords but also harder to crack using common brute force methods. Bitwarden can generate both passwords and passphrases. - Don’t reuse the same passwords for every service because one service may become compromised resulting in your access to every service being compromised.
Password vs. Passphrase: Differences Defined & Which Is Better?
Security questions
Sometimes you may be asked to provide security questions in case you forget your password but these security questions and answers can be some of the most difficult things to remember. So, instead you can just include the answers in your password manager.
Two-Factor Authentication (2FA)
There are a few different ways to authenticate a user:
- Asking for something that a user knows e.g. a password or pin
- Asking for something that the user has e.g. phone number, one-time-password (OTP) generator
- Asking for something that the user is e.g. biometrics such as facial recognition
It is more secure to authenticate a user through multiple methods of authentications to reduce the risk of security breaches due to one method being compromised. It is important that these methods are different as well. Asking someone to verify themselves using two passwords is not meaningfully more secure than verifying using one password.
So, for example, ideally you would authenticate with something you know (a password) and something that you are (biometrics).
Something that you have
SMS
One of the most common secondary forms of authentication is to enter a 6-digit code that is sent to your phone number. This is often regarded as a poor form of authentication due to the risk of sim swapping attacks where a hacker will impersonate you and ask your mobile phone provider to port over your number to another phone.
Usually, SMS 2FA should be used for services where SMS 2FA is the only form of 2FA and for non-critical services if you can reset your password through only SMS. Services which allow a user to reset their password through SMS compromises the security of 2FA by reducing the forms of authentication required to gain access to an account to only one form of authentication.
SMS Two-Factor Authentication – Worse Than Just a Good Password?
Exposing The Flaw In Our Phone System
One-time-password (OTP) Generator
OTP generators like Google Authenticator are another form of “something that you have” authentication because the unique code generator should only exist on one device, usually your phone.
One of the risks with OTP generator apps are that if you lose your phone or your phone breaks you will no longer be able to log in to your accounts. Usually, when setting up OTPs, you will be asked to securely save a list of backup codes in case you cannot access your OTP generator app. These backup codes can either be printed out and stored physically or stored inside your password manager alongside your login details for that particular site.
Another risk with OTPs are that some apps, notably including Authy and Google Authenticator, allow you to sync your OTPs across multiple devices. All you need to do is login to your OTP generator account, and you will be able to access all of your OTPs. On the plus side, syncing your OTPs across your devices means that you do not have to worry about losing your phone. However, you will be compromising the security of your services that use OTPs as 2FA because now all you need is the password to your OTP generator account and your password to that particularly service, which are both the same form of authentication (something that you know).
The key to using an OTP generator which syncs your OTPs to an account is to secure access to that account using 2FA. You most likely would not want to use an OTP to gain access to your OTP account and so, an alternative is to use a physical form of authentication such as a Yubikey. For example, Bitwarden can store OTPs and can be secured using both a password and a Yubikey.
Physical security keys
Physical security keys such as a Yubikey require a user to plug in their key or touch their key to their device when logging in. These are very useful because unlike other forms of authentication, physical security keys are practically invulnerable to phishing attacks because to log into an account, someone must have the key in their possession as opposed to a 6-digit code which could be easily sent via text.
Given that security keys can be quite inconvenient to use frequently, they are usually only used for the most critical services / accounts such as email or password managers.
One of the risk with physical security keys are that they can be lost. Usually, it is good to buy two keys and register both with each service so that one can serve as a backup.
The other risk is that services usually want to give users a way to gain access to their accounts in the case where they have lost their 2FA. If a service allows you to reset your account access by sending an email, then the security of that account is dependent on how secure your email address is.
Email based authentication
Some services require you to enter a code sent to your email address. This is not inherently a second form of authentication and is completely based on how you have secured your access to your email. If you have set up 2FA with your email, then sending a code to your email address would be a solid form of 2FA whereas if your email is only secured with a password then this is not a good form of 2FA.
Log in with Social Media
Another common form of authentication is logging in via a social media account. For example, “Sign in with Google” allows you to create an account with various services without creating a password.
This is usually the most convenient and secure form of authentication for most users. The security of this form of authentication is dependent on how secure your social media account is, so the previous methods of authentication still apply.
As a note, it can be difficult to keep track of which social media account was used to log in to a particular service. So, it can be helpful to create a log in with your password manager to keep track.
One of the risks with this form of authentication is that if access to your social media account is compromised, then you will lose access to all of your other accounts.
There is also a risk that the social media service could suffer from an outage and so you would not be able to log in to other services during that time, but large social media services usually recover quickly.