Lock down your accounts: passwords and 2FA

Why this matters more now

Most people reuse a handful of passwords. That’s normal, because nobody can remember fifty of them. It’s also the gap most account takeovers walk through.

The attack has a name, credential stuffing. Someone takes email and password pairs from an old breach and tries them on banks, exchanges and email. It used to need some skill. Now it can be automated with cheap tools.

The fix is simple. Use one unique password per account, plus a second factor that can’t be phished.

2FA Two-factor authentication. A second check after your password, like a code or a key you tap.

Know which accounts matter most

Your email is the master key. Almost every “forgot password” link goes there. Do these first, in this order:

1. Email. Every account you have can be reset through it.
2. Your phone carrier account. Whoever controls your number can receive your SMS codes.
3. Exchanges and banks. Anywhere money can leave.
4. Your password manager itself.
5. Everything else, slowly, as you log in to it.

Check whether your email showed up in known breaches at haveibeenpwned.com. If it did, those passwords are already on lists.

Set up a password manager

A password manager makes and remembers a different password for every site. You only remember one.

• Bitwarden: open source, syncs across devices, publishes its security audits. You can also host it yourself.
• KeePassXC: open source, keeps everything in one encrypted file on your computer. No account, no sync unless you set one up.

For the main password, use a passphrase. The EFF method: roll five dice, look up the word in EFF’s long wordlist, and repeat until you have six words. Write it on paper until you know it by heart. Keep that paper somewhere safe, away from your computer.

Never put seed words in a password manager. Your Bitcoin seed stays offline, on paper or steel. See the dice seed guide.

Give every account its own password

1. Log in to your email. Change the password to a new one from the password manager’s generator.
2. Use 20 random characters, or 5 or more random words.
3. Save it in the manager. Then log out and back in to test it.
4. Repeat for the accounts in Step 2.
5. For everything else, change the password the next time you log in.

NIST, the US standards body, now says length matters most. It wants at least 15 characters when a password is the only thing protecting an account, no forced mix of symbols, and checks against leaked password lists.

Most password managers can list which saved passwords are reused or leaked. Look for a health or reports section.

Pick your second factor

From strongest to weakest:

1. In each account, open the security settings and find two-step login or 2FA.
2. Add a security key or passkey if the site offers it. Register both keys, so you have a spare.
3. If keys aren’t offered, use an authenticator app. Aegis (Android) and Ente Auth are open source and let you export an encrypted backup.
4. When everything works, remove SMS as a 2FA option where the site allows it.

SIM swap Someone talks your carrier into moving your number to their SIM. Then your SMS codes go to them.

Save your recovery codes

Most sites give you a list of one-time recovery codes when you turn on 2FA. They get you back in if you lose your phone or key.

1. Print or write down the recovery codes for your email, carrier and money accounts.
2. Store them away from your computer. Store them apart from your seed backup too.
3. Keep the spare security key in a different place from the main one.
4. If you use an authenticator app, turn on its encrypted backup or export, and test that you can restore it.

Ask your carrier for a port-out PIN or SIM lock. It makes a SIM swap much harder. The FBI has warned about SIM swaps used to empty accounts.

Habits that keep it working

1. Type sensitive addresses yourself or use a bookmark. Don’t log in from links in emails or texts. AI makes fake emails look very real.
2. Let the password manager fill passwords in. If it won’t fill on a page, look twice at the address.
3. Keep your phone updated. If you want to go further, see the GrapheneOS guide.
4. Never share a 2FA code with anyone who calls or messages you. Real support staff won’t ask.

One step for today

Pick one account: your main email.

1. Install a password manager and set a six-word main passphrase.
2. Change your email password to a new random one and save it in the manager.
3. Turn on 2FA with an authenticator app or a security key.
4. Write down the recovery codes and put them somewhere safe.

That one account protects most of the others. Do the rest over the next few weeks as you log in.