<\/p>\n
A strong password is essential when it comes to your online security, and you need a unique one for each of your social media, bank accounts<\/span>, streaming services<\/span>\u00a0and apps<\/span>. But with so many accounts to keep track of, it’s tempting (and incredibly easy) to fall into the bad habit of using the same login credentials for everything.\u00a0<\/p>\n If your data is compromised, weak passwords can have serious consequences like identity theft. Last year’s number of reported data breaches\u00a0set a new record<\/span> — not to mention the T-Mobile hack in 2021 that exposed more than 50 million customers’ personal information<\/span>.<\/p>\n The identity protection of a post-password world<\/span> isn’t here for most of us. So in the meantime, try these best practices that can help minimize the risk of your data being exposed. Read on to learn how to create and manage the best passwords, how to be alerted if they’re breached, and one crucial tip to make your logins even more secure. And here are three old password rules that wound up being dumb today<\/span>.<\/p>\n Read more:\u00a0<\/strong>Best Password Managers for 2022 and How to Use Them<\/span><\/p>\n Strong passwords are longer than eight characters, are hard to guess and contain a variety of characters, numbers and special symbols. The best ones can be difficult to remember, especially if you’re using a distinct login for every site (which is recommended). This is where password managers come in.<\/p>\n A trusted password manager such as 1Password or Bitwarden<\/span>\u00a0can create and store strong, lengthy passwords for you. They work across your desktop and phone.<\/p>\n A good password manager can help you keep track of your login info.<\/p>\n <\/span><\/figcaption><\/figure>\n The tiny caveat is that you’ll still have to memorize a single master password that unlocks all your other passwords. So make that one as strong as it can be (and see below for more specific tips on that).<\/p>\n Browsers like Google’s Chrome<\/span> also come with password managers, but our sister site TechRepublic has concerns about how browsers secure the passwords they store<\/a> and recommends using a dedicated app instead.\u00a0<\/p>\n Password managers with their single master passwords are, of course, obvious targets for hackers. And password managers aren’t perfect. LastPass fixed a flaw<\/span>\u00a0in 2019 that could have exposed a customer’s credentials. To its credit, the company was transparent about the potential exploit<\/a> and the steps it would take in the event of a hack<\/a>.<\/p>\n Read more:\u00a0<\/strong>Why Password Managers Are Great Until You Lose Your Password<\/span><\/p>\n We know: This recommendation goes against everything we’ve been told about protecting ourselves online. But password managers aren’t for everyone, and some leading security experts, like the Electronic Frontier Foundation<\/a>, suggest that keeping your login information on a physical sheet of paper or in a notebook is a viable way to track your credentials.\u00a0<\/p>\n And we’re talking about real, old-fashioned paper, not an electronic document like a Word file or a Google spreadsheet, because if someone gains access to your computer or online accounts, they can also gain access to that electronic password file.<\/p>\n Keeping passwords on a sheet of paper or in a notebook might work best for some people.<\/p>\n <\/span> Of course, someone could also break into your house and walk off with the passkeys to your entire life, but that seems less likely. At work or at home, we recommend keeping this sheet of paper in a safe place — like a locked desk drawer or cabinet — and out of eyesight. Limit the number of people who know where your passwords are, especially to your financial sites.<\/p>\n If you travel often, physically carrying your passwords with you introduces greater risk if you misplace your notebook.\u00a0<\/p>\n Read more<\/strong>:\u00a05 Ways to Make Your Passwords Instantly More Secure<\/span><\/p>\n You can’t always stop your passwords from leaking out, either through a data breach or a malicious hack<\/span>. But you can check at any time for hints that your accounts might be compromised.<\/p>\n Mozilla’s<\/a> Firefox Monitor<\/a> and Google’s<\/a> Password Checkup<\/a> can show you which of your email addresses and passwords have been compromised in a data breach so you can take action. Have I Been Pwned<\/a> can also show you if your emails and passwords have been exposed. If you do discover you’ve been hacked, see our guide for how to protect yourself<\/span>.<\/p>\n The goal is to create a password that someone else won’t know or be able to easily guess. Stay away from common words like “password,” phrases like “mypassword” and predictable character sequences like “qwerty” or “thequickbrownfox.”\u00a0<\/p>\n Also avoid using your name, nickname, the name of your pet, your birthday or anniversary, your street name or anything associated with you that someone could find out from social media, or from a heartfelt talk with a stranger on an airplane or at the bar.\u00a0<\/p>\n 8 characters are a great place to start when creating a strong password, but longer logins are better. The Electronic Frontier Foundation<\/a> and security expert Brian Krebs<\/a>, among many<\/a> others<\/a>, advise using a passphrase made up of three or four random words for added security. A longer passphrase composed of unconnected words can be difficult to remember, however, which is why you should consider using a password manager.<\/p>\n Read more:<\/strong>\u00a0Strong Passwords Aren’t as Easy as Adding 123. Here’s What Experts Say Really Helps<\/span><\/p>\n It’s worth repeating that reusing passwords across different accounts is a terrible idea. If someone uncovers your reused password for one account, they have the key to every other account you use that password for.\u00a0<\/p>\n The same goes for modifying a root password that changes with the addition of a prefix or suffix. For example, PasswordOne, PasswordTwo (these are both bad for multiple reasons).<\/p>\n By picking a unique password for each account, hackers that crack into one account can’t use it to get access to all the rest.\u00a0<\/p>\n Hackers can effortlessly use previously stolen or otherwise exposed passwords in automated login attempts called credential stuffing<\/a> to break into an account. If you want to check if a password you’re considering using has already been exposed in a hack, go to Have I Been Pwned<\/a> and enter the password.<\/p>\n For years, changing your passwords every 60 or 90 days was a long-accepted practice, because\u00a0the thinking went<\/a>\u00a0that was how long it took to crack a password.\u00a0<\/p>\nUse a password manager to keep track of your passwords<\/h2>\n
Yes, you can write your login credentials down. Really<\/h2>\n
\n Graphic by Pixabay\/Illustration by CNET
\n <\/span><\/figcaption><\/figure>\nFind out if your passwords have been stolen<\/h2>\n
Avoid common words and character combinations in your password<\/h2>\n
Longer passwords are better: 8 characters is a starting point<\/h2>\n
Don’t recycle your passwords, seriously<\/h2>\n
Avoid using passwords known to be stolen<\/h2>\n
No need to periodically reset your password<\/h2>\n