Chapter 4
Passwords, passkeys, and keys
What you'll get from this chapter: How to stop one leaked password from unlocking all your accounts, and the ranked order of sign-in protection, from strongest to weakest.
In this chapter
- Words in this chapter
- Your steps
Using one password on many sites is how a single company breach becomes many stolen accounts.
A is an app that creates a long, unique password for every site and remembers it for you. It is the only realistic way to stop reusing passwords. Bitwarden is a strong free, open-source option. 1Password is the smoothest for daily use. Proton Pass fits if you already use Proton’s other services.
The order of protection is: first, then a , then an authenticator app, then text-message codes (also called codes, short for short message service). Text-message codes can be stolen with a , a trick where a criminal moves your phone number to their own phone. Hardware keys refuse to answer a fake website.
Check your old passwords at haveibeenpwned.com, a free site that shows whether your email appeared in a known data breach. If a password was exposed, change it everywhere you reused it, and then stop reusing it.
Not every scam goes after your passwords. Some go after your heart. The next chapter covers .
Words in this chapter
- . An application that creates and stores a different long password for every account, so you only have to remember one master password.
- . A criminal convinces your mobile carrier to move your phone number onto their card, then receives your calls and text-message codes.
- . A sign-in bound to your device and to the real website. A look-alike page cannot use it, because the passkey checks the site’s true address.
- . A small physical device, such as a YubiKey, that you tap to approve a sign-in. Buy two. Keep one somewhere else.
- . Short message service: the technical name for ordinary text messages. "SMS codes" are sign-in codes sent to you by text.