Passwords and Account Recovery Planning

Why reuse is the core problem

Breaches expose credentials regularly, and attackers try them across other services automatically.

One reused password therefore compromises every account sharing it.

Password complexity matters far less than uniqueness. A moderately complex unique password beats a very complex reused one.

Password managers

They generate and store distinct passwords for every account, requiring you to remember one.

That master password should be long and memorable — a passphrase of several unrelated words works well — and used nowhere else.

Browser-built managers are adequate for most people and far better than reuse. Dedicated managers offer more features and cross-platform support.

The objection that storing everything in one place is risky is understandable and is outweighed by eliminating reuse.

Two-factor authentication

Adds a second requirement beyond the password, which defeats most credential theft.

Authenticator apps are considerably more secure than text message codes, which can be intercepted through number transfer attacks.

Hardware keys are the strongest option and worth it for critical accounts.

Enable it on email first, since email controls password resets for everything else.

The recovery problem

Losing access to the manager or the second factor locks you out comprehensively.

Store recovery codes for every service, printed and kept somewhere secure and physical.

Register a second authentication method where the service allows it.

Keep a copy of the master password somewhere trusted and physically secure.

Planning for the worst case

Consider who would need access if you were unable to provide it: a partner, an executor.

Some managers offer emergency access with a delay period, which handles this without giving access now.

Leaving instructions on how to reach the information, without leaving the information itself in an insecure place, is the practical middle ground.

Review the arrangement occasionally, since services and devices change.

Migrating without creating a gap

Moving to a manager is usually done gradually rather than in one session, which is why many attempts stall halfway.

Import saved browser passwords first, which populates the manager immediately and shows the scale of the problem.

Then work through the accounts by importance rather than alphabetically: email, banking, and anything holding payment details first.

Change reused passwords as you go rather than only recording them, since recording a reused password preserves the vulnerability.

Delete the passwords stored in the browser once the manager holds them, so there is one source of truth.

Passphrases and why length beats complexity

Four or five unrelated words are easier to remember and harder to attack than a short string of substituted characters.

Predictable substitutions — a zero for an o, an exclamation mark at the end — are anticipated by attack software and add very little.