Passwords, MFA and Passkeys: Protect Your Online Accounts

There's more to it than you might think!

AI generated image

Keywords:
password, hashing, security, attacks, authentication

Key Takeaway:
Passwords are the keys to our digital lives, granting access to everything from social media and banking to work emails and online shopping.

Category Insights:
SECURITY — Security best practices include strong passwords, MFA, and regular patching.

Introduction

Passwords are the keys to our digital lives. They grant access to everything from social media and banking to work email, online shopping, and personal information. But have you ever wondered what happens when you enter your password? How does a website know it is really you?

Passwords have been around for decades, but the methods used to protect accounts continue to evolve. Strong passwords are still important, but multi-factor authentication (MFA), passkeys, and password managers can make your accounts much harder for criminals to access.

The good news is that you don't need to be a computer expert to improve your security. A few simple changes can make a significant difference.

The Basics of Password Authentication

When you create an account, the website or application needs a way to verify your password when you return. Well-designed systems do not store your actual password in plain text. Instead, they use a process called hashing.

Hashing converts a password into a string of characters using a mathematical process called a hashing algorithm. The website stores the resulting hash rather than your original password.

Hashing is designed to work in one direction. The original password cannot simply be converted back from the resulting string. However, criminals who steal a password database can still attempt to guess passwords and check whether their guesses produce matching hashes.

For example, if someone uses a password such as MySecurePass123, a hashing algorithm converts it into a string of characters. The exact result depends on the algorithm and other details of the process.

When you log in, the system checks the password you entered against the stored information. If the results match, the system knows you entered the correct password and allows you to proceed.

This process happens behind the scenes, usually in a fraction of a second.

Why Hashing Matters

Imagine what would happen if a website stored every customer's password in a plain text file. If criminals broke into the system and stole that file, they could immediately read every password in it.

Hashing helps prevent this. If the website stores properly protected password hashes instead of actual passwords, stealing the database does not automatically reveal everyone's credentials.

However, hashing is not a magic shield. Criminals can use automated software to guess passwords, hash those guesses, and compare the results with stolen data. Simple passwords can sometimes be discovered surprisingly quickly.

Not all hashing algorithms offer the same level of protection. Older algorithms, such as MD5 and SHA-1, are unsuitable for modern password storage. Systems designed to protect passwords should use specialized password-hashing methods such as bcrypt, Argon2, or PBKDF2, configured appropriately.

These methods make it more difficult and time-consuming for criminals to test large numbers of password guesses.

The Role of Salting

Modern password storage systems can add another layer of protection through a technique called salting.

A salt is a unique, randomly generated value added to a password as part of the hashing process. It helps ensure that identical passwords do not produce identical stored hashes.

For example, suppose two people use the same password on a website. Without salting, the stored hashes could be identical. With a unique salt for each password, the resulting hashes will normally be different.

This makes it harder for criminals to use precomputed collections of password hashes to identify passwords in a stolen database.

You don't need to create a salt yourself or change any settings. The website or application is responsible for implementing this protection. The important point is that secure password storage involves more than simply running a password through an ordinary hashing algorithm.

How Hackers Try to Steal or Crack Passwords

Criminals have several ways to obtain passwords. Some use automated software to try possible combinations until they find a match. This is known as a brute-force attack.

Dictionary attacks focus on common passwords and predictable variations. Passwords such as 123456, password, and familiar words followed by simple numbers are particularly poor choices.

Credential stuffing is another common technique. Criminals take usernames and passwords exposed in one data breach and try them on other websites. This works because many people reuse passwords across multiple accounts.

Phishing attacks attempt to trick people into handing over their credentials. You might receive an email or text message claiming that your bank account has a problem, a package cannot be delivered, or your email account needs attention. The message directs you to a fake website that looks legitimate and asks you to sign in.

If you enter your password on that fake page, the criminal may receive it immediately.

Some attacks use malware to steal saved credentials, while others attempt to trick people into revealing verification codes or approving fraudulent sign-in requests.

A strong password helps defend against guessing, but it cannot prevent every type of attack. This is one reason additional security measures are so valuable.

Never Use the Default Password

This deserves special attention because it is an easy mistake to overlook.

When you purchase a router, security camera, network device, or other connected product, it may come with a default username and password. Some devices use a common password, while others have a unique password printed on a label. Some require you to create a password during initial setup.

Never leave a device using a default password if you can change it. Replace it with a strong, unique password during setup.

Default credentials may be documented in the manufacturer's manual or available online. Criminals can use automated tools to search for devices that still have known default login information.

If someone gains access to your router or security camera, they may be able to change its settings, spy on activity, or use the device as a starting point for attacks against other equipment on your network.

This is particularly important for home routers, business network equipment, security cameras, network storage devices, and internet-connected appliances.

If your device uses a unique password printed on its label, that is generally better than a universal default, but you should still follow the manufacturer's security recommendations. Change any administrator password that the manufacturer allows you to change.

Also remember that the password used to connect to your Wi-Fi network is not necessarily the same as the administrator password used to manage the router. Both need to be protected.

How to Protect Your Passwords

One of the most effective ways to improve password security is to use a different, strong password for every account.

That may sound difficult if you have dozens or hundreds of accounts, but password managers make it practical. They can generate long, random passwords and store them securely, so you don't have to memorize each one.

Avoid using personal information such as your name, birthday, address, or pet's name. Information like this may be easy for someone to discover through social media or other public sources.

For most accounts, let your password manager generate a long, random password. Your master password for the manager is different: choose a strong, unique passphrase that you can remember, and never reuse it on another website.

What Is Multi-Factor Authentication (MFA)?

Multi-factor authentication, commonly called MFA, adds another layer of protection to your account. Instead of relying on a password alone, the service requires you to prove your identity using an additional method.

Think of it like having two locks on a door. A criminal who obtains the key to the first lock still has another obstacle to overcome.

MFA usually combines two or more different types of proof. These include something you know, such as your password; something you have, such as your phone or a security key; or something you are, such as a fingerprint or facial recognition.

For example, you might enter your password and then approve a sign-in request on your phone. Another service might ask you to enter a temporary code generated by an authenticator app.

Even if a criminal steals your password, MFA can prevent access if the criminal cannot complete the additional verification step.

MFA is especially important for your primary email account, banking and financial accounts, password manager, cloud storage, and business accounts. Your email account deserves particular attention because it is often used to reset passwords for other services.

Different Types of MFA

Text-message verification is one of the most familiar forms of MFA. A service sends a temporary code to your phone, and you enter that code after your password. This is generally better than using a password alone, but it is not the strongest option. Criminals may sometimes hijack a phone number or trick someone into sharing a code.

Authenticator apps provide another option. Apps such as Microsoft Authenticator, Google Authenticator, and other compatible authenticators can generate temporary codes that change periodically. These codes are not delivered through text messages, so they avoid some of the risks associated with phone-number hijacking.

Some services use push notifications. After you enter your password, your phone displays a request asking whether you are trying to sign in. You approve the request if it is legitimate. Never approve a sign-in notification that you did not initiate. Repeated unexpected prompts may mean someone has your password and is trying to get past your security.

Security keys offer another strong option. These are physical devices, often connected through USB or using NFC, that help verify your identity when signing in. When supported by a service, compatible security keys can provide excellent protection against phishing.

Not all MFA methods offer the same level of protection. If a service offers a passkey or a compatible security key, these are often preferable to text-message codes. However, using an authenticator app is generally better than relying on a password alone.

Keep backup codes in a safe place when a service provides them. They can help you regain access if your phone is lost or replaced. Do not store your only copy of the backup codes in the same account you are trying to protect.

What Are Passkeys?

Passkeys are a newer way to sign in without typing a traditional password. Instead of remembering a password for every website, your device or password manager stores a special digital credential that works with the service you are accessing.

When you create a passkey, your device generates a pair of related digital keys. The website stores one part, while the other stays protected by your device or password manager. During sign-in, the two parts work together to verify that you have the correct credential.

You do not need to understand the mathematics behind this process. From your perspective, signing in might be as simple as selecting your account and using your fingerprint, face recognition, or device PIN.

A major advantage of passkeys is that they are designed to resist phishing. A passkey is associated with the legitimate website or service, making it much harder for a fake website to trick you into handing over a reusable credential. There is also no traditional password for a criminal to steal from the website's password database.

Passkeys can be stored on a phone, computer, or compatible password manager. Depending on the platform, they may synchronize securely between your devices, or you may need to use a different supported method to sign in on another device.

Passkeys are not the same as simply using a fingerprint to unlock a computer. A fingerprint or PIN can unlock the device or authorize the use of a passkey, but the passkey is the credential that proves your identity to the website.

Passkeys are becoming available on many major websites and services, although not every service supports them yet. If a website offers the option, creating a passkey is often a good choice.

You should still protect the device or password manager that holds your passkeys, keep your devices updated, and understand how account recovery works. A passkey is a significant security improvement, but it does not eliminate every possible risk.

Password Managers: A Better Way to Manage Passwords

If you have ever struggled to remember a password, you already understand the problem password managers are designed to solve.

A password manager securely stores your login information in an encrypted vault. You need to remember one strong master password, and the application helps manage the rest. Many password managers can generate long, random passwords for new accounts and automatically fill them in when you visit a website.

For example, instead of using the same password for ten different websites, you can have ten completely different passwords without memorizing any of them.

Password managers can also help identify weak or reused passwords, and some can alert you to accounts that may have been involved in a known data breach. Many now support passkeys as well.

A password manager is particularly useful if you manage numerous personal accounts, family devices, or business logins. Some products also offer secure sharing, which can be useful when family members or authorized employees need access to shared accounts.

However, the password manager itself is an important account to protect. Choose a strong, unique master password, enable MFA when available, and keep recovery information somewhere safe. Never share your master password with someone who should not have access to your entire vault.

Recommended Password Manager Applications

Several reputable password managers are worth considering. The best choice depends on your devices, budget, and whether you need to share passwords with other people.

Bitwarden is a strong option for people who want an affordable password manager with a useful free plan. It supports major operating systems and browsers, can generate strong passwords, and supports passkeys. Paid plans add features, and it is worth considering for individuals, families, and small businesses.

1Password is another excellent option, particularly for people who want a polished experience across multiple devices. It offers password storage, password generation, passkey support, and features for sharing information securely. It is a paid service, with plans for individuals, families, and businesses.

Proton Pass is worth considering if you want a password manager from a company known for privacy-focused services. It offers password storage, password generation, and passkey support, with free and paid options. Available features vary by plan.

Google Password Manager is another convenient built-in option for people who use Chrome and Android devices. It stores passwords and supports passkeys within Google's ecosystem. It is a practical starting point if you want to improve password security without installing a separate application.

Before choosing a product, check its current features, pricing, device compatibility, and recovery options. Paid plans and included features can change. If you are managing passwords for a business, look specifically at business-oriented plans that provide secure sharing and centralized access management.

My recommendation is to start with a password manager you will actually use. Bitwarden is a good place to begin if you want a dedicated password manager with a free option. Apple Passwords or Google Password Manager may be sufficient if you prefer the convenience of tools already built into your devices.

Regardless of which one you choose, avoid keeping your passwords in an ordinary text file, spreadsheet, or document that is not properly protected. A dedicated password manager is designed for this job.

Should You Change Your Password Regularly?

You may have heard that every password should be changed every 30, 60, or 90 days. Routine password changes are not necessarily helpful when you already use strong, unique passwords and there is no sign of a problem.

Frequent forced changes can encourage people to make small, predictable adjustments, such as changing Password1 to Password2. That does little to improve security.

Instead, change a password immediately if you believe it has been stolen, if a service reports a relevant security incident, if you accidentally disclosed it, or if you discover that you have reused it on other accounts. Follow your organization's security policies when they require specific changes.

If you have reused one password across several services, replace it with a different, strong password on each account. Prioritize your email, financial accounts, password manager, and other accounts that could be used to reset or access additional services.

Other Simple Ways to Improve Your Security

Keep your computer, phone, browser, and applications updated. Security updates fix weaknesses that criminals may otherwise exploit.

Be careful with unexpected emails, text messages, and phone calls. Do not click a sign-in link simply because a message claims there is an urgent problem. Instead, open the official website or application yourself and check your account.

Enable MFA wherever it is available, especially for important accounts. Use passkeys when supported and protect your password manager with a strong master password and additional authentication.

Review your account recovery settings and make sure your recovery email address and phone number are current. If a service provides a list of devices or recent sign-ins, review it periodically and remove anything you do not recognize.

Finally, back up important data. Password security helps protect access to your accounts, but it cannot protect every file from equipment failure, ransomware, or accidental deletion.

Conclusion

Passwords remain an important part of online security, but relying on a password alone is no longer the best approach for protecting important accounts.

Use strong, unique passwords, never leave devices using default passwords, and avoid reusing credentials. A password manager makes it easier to follow these recommendations without having to remember dozens of complicated passwords.

Enable multi-factor authentication wherever possible, and consider passkeys when a service supports them. These additional protections can make it much harder for criminals to gain access, even if they manage to obtain your password.

You do not have to change everything at once. Start with your primary email account, then secure your financial accounts and password manager. Work through the rest as time allows.

A few minutes spent improving your security today could save you considerable time, money, and frustration later.