Passwords & 2FA

Part of EFF's Surveillance Self-Defense guide. It argues for a different password on every account to limit damage from leaks, with a password manager doing the work, and a random multi-word passphrase for high-value logins such as your device and the manager itself.

Advice on using a unique strong password per account and why to enable two-step verification first. Describes how browser-based and third-party password managers store, generate and autofill passwords and can warn about breaches.

The NCSC shows how chaining three unrelated words makes a password that is hard to crack but still memorable. It also warns against personal details and predictable character swaps, and mentions password managers as an alternative.

Explains how a second check at login keeps criminals out of email, banking and social media accounts even if they have your password. Points to setup guides for popular services such as Gmail, Outlook, Instagram, Amazon and Apple ID.

A short guide to multifactor authentication, which asks for a second proof of identity so a stolen password alone is not enough. CISA urges turning it on for every account that offers it and outlines the basic setup.

CISA explains why short or guessable passwords make accounts easy to break into, using a short story about a reused password. It recommends long, unique passwords generated and stored by a password manager.

A one-page printable sheet covering how criminals get hold of passwords, how to build strong ones, and how to store them safely. It also covers setting up two-step verification, protecting your email account and what to do if a password is stolen.

EFF's Surveillance Self-Defense guide ranks second-factor options from strongest to weakest and explains tradeoffs such as lockout risk and SMS weaknesses. It recommends securing email first, then cloud backup accounts, then everything else.