Unique credentials
Ten minutes once, closing one entry completely and reducing another. Nine of those minutes are easy and one is the one people skip.
Uniqueness rather than strength
Strength protects against guessing, and guessing is not the attack. A leaked credential pair from an unrelated service gets tried everywhere automatically. A long complicated password reused somewhere that leaked it is exactly as useless as a short one, and it comes with more confidence attached.
What a second factor covers
| Attack | Stopped? |
|---|---|
| A leaked password tried later | Yes, completely |
| A live copy of the login page | No. Password and code are collected together and replayed while the code is valid. |
| Something on your own machine | No. Nothing on the account side helps. |
The minute people regret
- Save the recovery material at setup, before closing the page.
- Keep it separate from the password. Both in one place is one factor wearing a costume.
- Do not keep the only copy on one device.
- Not in a screenshot. Photo libraries sync, back up, and get indexed by software that reads text in images.
- Test once that you can produce it from a second place.
The name, decided at the same time
Not one used anywhere else and not a variation on one you use, because variations are trivially matched. Unlike a password this cannot be changed later without abandoning the record attached to it, which is covered at rank twelve.
What to actually use
| Choice | Verdict |
|---|---|
| A generated string from a password manager | Best. Uniqueness is automatic and nothing is memorised. |
| Several unrelated words, written down | Fine, provided the words are chosen randomly rather than by you. |
| A phrase with substitutions | Weak, and the substitutions are the part that adds least. |
| Anything reused from elsewhere | Fails regardless of how strong it is. |
The manager, and its one trade-off
A password manager makes uniqueness free, which is the whole problem solved. In exchange there is one file that matters more than anything in it, so it needs a passphrase used nowhere else and a backup you control. Local storage with your own backups is the straightforward choice here. A syncing service is a different trade and worth making as a decision rather than accepting as a default.
Changing one that is already reused
- Start with this account, because it is the one holding money.
- Then the email address behind it, if there is one, since anything able to reset that resets everything downstream.
- Then anywhere the same pair was used, which is usually more places than you remember.
- Do not change it to a variation of the old one. A pair already in circulation makes the variations cheap to derive.
Doing this properly takes an evening once and never needs repeating, which puts it among the best returns available on this site.
What this does not cover
A copy of the login page collects a unique password just as happily as a reused one, because you handed it over rather than having it guessed. Uniqueness closes rank five completely and does nothing for rank two. Different failures, similar appearance, separate answers, and confusing the two is why people believe a strong password is a general defence.