101 Digital Life Security #5: Passwords, Password Managers, MFA and Passkeys

Digital Life Security Series ...Practical ways to protect your devices, accounts, privacy, information and home

For decades, one small box has stood between us and much of our digital lives:

Password: ____________________

We have been told to make passwords long.

Make them complicated.

Do not write them down.

Do not reuse them.

Change them regularly.

Include uppercase letters, lowercase letters, numbers, symbols, and perhaps something only a computer could love.

Meanwhile, the average person may have dozens or even hundreds of online accounts.

There is an obvious problem.

Human memory was never designed to be a password database.

What Are We Actually Trying to Prove?

Before talking about passwords, it helps to understand the larger concept.

When you log into an account, the system is attempting to answer a question:

Are you really the person who should be allowed in?

This process is called authentication.

Authentication can use several types of evidence.

Traditionally, they are often described as:

• Something you know — such as a password or PIN
• Something you have — such as a phone or security key
• Something you are — such as a fingerprint or other biometric characteristic

Modern authentication systems may combine these ideas in different ways.

Understanding these factors helps explain why adding another authentication method can make an account considerably harder to take over.

The Biggest Password Problem Is Reuse

Suppose you create an excellent password.

It is long, difficult to guess, and contains a mixture of characters.

Then you use that same password on twenty websites.

One of those websites suffers a data breach and password information is exposed or eventually recovered by attackers.

The attackers now have something extremely valuable:

Your email address and a password you may have used somewhere else.

Automated systems can try those credentials against other services.

Email.

Shopping sites.

Social networks.

Cloud storage.

Financial services.

This technique is commonly called credential stuffing.

The attacker does not have to guess your password.

You already gave the same password to another service.

Unique Is More Important Than Clever

This leads to one of the most important password rules:

Important accounts should have unique passwords.

If one company's credentials are compromised, that password should not unlock your accounts elsewhere.

Think of physical keys.

Imagine using exactly the same key for your house, car, office, safe, workshop, and every building you own.

Lose one key and everything becomes vulnerable.

Unique passwords create separate locks.

Long Passwords Matter

Length is an important part of password strength.

Every additional character can greatly increase the number of possible combinations an attacker would need to consider in a brute-force search.

This is why modern advice increasingly favors long passwords or passphrases rather than forcing people to create short strings filled with difficult-to-remember substitutions.

A long password does not need to look like random punctuation to be stronger than a short predictable password.

For passwords generated and stored by a password manager, however, there is little reason for humans to make them memorable at all. The software can create long random passwords and remember them for us.

Should We Change Passwords Regularly?

For years, many organizations required users to change passwords every 30, 60, or 90 days.

That sounds safer, but mandatory frequent changes can encourage predictable behavior.

A person may change:

Woodshop2025!

to:

Woodshop2026!

The password technically changed, but the security improvement may be minimal.

Modern security practice generally places more emphasis on strong unique passwords and changing them when there is evidence or reason to believe they may have been compromised, rather than changing good passwords simply because the calendar says so.

Enter the Password Manager

A password manager solves one of our biggest problems:

We cannot realistically remember a different strong password for every account.

Instead, the password manager stores those credentials in a protected vault.

You protect access to the manager itself, and the manager remembers the individual account passwords.

It can also generate passwords that look something like:

v7!Qp2#Lm9@Rx4$Nz8

You do not need to remember that.

That is the point.

But Aren't All My Eggs in One Basket?

This is a reasonable question.

If a password manager contains many of your passwords, doesn't that make it an especially valuable target?

Yes.

That is why the security of the password manager itself is extremely important.

But compare that risk with the alternative.

Without a password manager, many people reuse passwords, create predictable variations, save them in insecure places, or choose passwords simple enough to remember.

A well-designed password manager allows strong, unique credentials to be practical.

The goal is not to eliminate all risk.

It is to manage risk intelligently.

Protect the Password Manager

Your password manager deserves particularly strong protection.

Use a strong master password or other secure authentication method.

Enable multifactor authentication when supported.

Keep recovery information current.

Protect the devices where the password manager is installed.

And understand how account recovery works before you need it.

The more important an account is, the more important it becomes to understand both how you get into it and how someone could attempt to recover it.

Autofill Can Provide a Security Benefit

Password managers are convenient because they can automatically fill credentials into websites and applications.

But there can also be a security benefit.

A human may look at a fraudulent login page and think it looks exactly like the real one.

A properly functioning password manager associates credentials with the appropriate website or service.

If you arrive at an imitation site using a different domain, the password manager may not offer the expected credentials.

That should get your attention.

If your password manager normally fills a login and suddenly does not, stop and examine where you are.

What Happens When a Website Stores Your Password?

Here is where we can look under the hood.

A properly designed website should not need to store your actual password in readable form.

Instead, it can process the password using a special one-way password hashing function and store the resulting value.

When you later log in, the password you enter is processed appropriately and compared against the stored password representation.

The idea is that the server can determine whether you supplied the correct password without maintaining a readable copy of the password itself.

This distinction becomes very important when a password database is stolen.

Hashing Is Not Encryption

These terms are sometimes used interchangeably, but they describe different ideas.

Encryption is designed to be reversible when you possess the appropriate key.

You encrypt information, and someone with the correct key can decrypt it.

Password hashing is designed as a one-way process.

The goal is not to recover the original password from the stored hash.

Instead, the system verifies a password by processing the submitted value and comparing it appropriately with the stored result.

This is our first encounter with a distinction that will become very important as we learn more about cybersecurity:

Encryption and hashing solve different problems.

What Is a Salt?

Secure password storage normally involves another concept called a salt.

A salt is unique data incorporated into the password hashing process.

This helps prevent identical passwords from automatically producing identical stored password values and makes large-scale precomputed password attacks less useful.

Modern password storage uses specialized password-hashing approaches designed to make password guessing computationally expensive.

For a website administrator, simply applying a fast general-purpose hash to passwords is not enough.

Later in this series, when we examine website security, we can look at how modern applications should actually store and verify passwords.

What Is Multifactor Authentication?

Now suppose someone obtains your password.

If the password is the only thing required to log in, the attacker may be able to access the account.

Multifactor authentication, commonly abbreviated MFA, adds another authentication factor.

The idea is simple:

Knowing the password alone should not be enough.

You might also need something associated with a device you possess, a security key, or another independent factor.

Not All MFA Is the Same

You may encounter several forms of additional authentication:

• Codes sent by text message
• Codes generated by an authenticator app
• Push notifications sent to a trusted device
• Hardware security keys
• Passkeys and device-based authentication

These methods do not all provide exactly the same protections.

For example, text-message verification can provide an important additional barrier, but it depends partly upon the security of the telephone account and mobile network.

Authenticator apps and hardware security keys can avoid some of those dependencies.

The important point is that an additional authentication layer can prevent a stolen password from immediately becoming a stolen account.

Be Careful With Login Approval Requests

Some services send a notification to your phone asking:

Are you trying to sign in?

That can be convenient.

But imagine an attacker already knows your password and repeatedly attempts to log in.

Your phone may repeatedly ask you to approve the login.

Eventually someone might press Approve simply to make the notifications stop.

This type of attack is sometimes called MFA fatigue or push bombing.

If you receive a login approval request that you did not initiate, do not approve it.

Instead, treat it as evidence that someone may be attempting to access the account.

Never Give Someone Your Verification Code

An attacker may already have your username and password but still need the second authentication step.

They may contact you pretending to be technical support, your bank, or another trusted organization and ask you to read back a code that just arrived.

That code may be the very thing preventing them from logging in.

A verification code should be treated like a temporary key.

Do not hand that key to someone who unexpectedly asks for it.

What Is a Passkey?

Passkeys represent an important change in authentication.

Instead of sending a shared secret such as a password to a website, passkeys use public-key cryptography.

A simplified way to think about it is that a pair of cryptographic keys is created.

The service receives a public key.

The corresponding private key remains protected by your device, credential provider, or synchronized credential system.

When you authenticate, the service presents a challenge that your credential can cryptographically sign.

The private key itself does not need to be sent to the website.

Why Passkeys Can Help With Phishing

This architecture provides an important security advantage.

Traditional phishing works very well against passwords because a person can be tricked into typing a password into a fake website.

Passkeys are designed around the identity of the legitimate website or application.

A credential created for one site cannot simply be entered into an attacker's imitation site in the way a reusable password can.

That makes passkeys much more resistant to traditional credential phishing.

What About Face ID, Touch ID, and Fingerprints?

Biometrics can be confusing because seeing your face or fingerprint used during login can make it seem as though the website itself receives that biometric information.

Often, that is not what is happening.

Your device may use a fingerprint, facial recognition, PIN, or device password locally to confirm that you are authorized to use a protected credential.

The remote service receives the result of the cryptographic authentication process rather than a copy of your fingerprint.

This distinction is important.

The biometric may be unlocking access to a credential rather than acting as a secret transmitted across the internet.

Recovery Is Part of Authentication Security

We often concentrate on the front door.

But attackers may look for the side door.

Suppose an account has an excellent password and strong multifactor authentication.

What happens when someone clicks:

I can't access my account.

If account recovery is weak, all the sophisticated authentication protecting normal login may be undermined.

This is why recovery email addresses, phone numbers, backup codes, trusted devices, and recovery procedures deserve the same attention as passwords.

A security system is only as strong as the ways around it.

Backup Codes Are Real Keys

Some services provide recovery or backup codes when multifactor authentication is enabled.

These codes may allow access when your normal second factor is unavailable.

That makes them extremely useful.

It also makes them sensitive.

Store recovery codes somewhere secure and separate from the situation they are intended to recover.

A backup key hidden inside the locked room it opens is not much help.

Protect the Accounts That Protect Everything Else

Not every account has equal importance.

Your email account may reset other accounts.

Your password manager may contain credentials for many services.

Your primary device account may control cloud storage, device synchronization, and credential recovery.

Your mobile account may receive authentication codes.

These are high-value accounts because they can influence access to many other systems.

Give them especially strong protection.

A Practical Authentication Checkup

Take a few minutes to examine the accounts that matter most.

• Are you reusing any important passwords?
• Are your important passwords long and unique?
• Would a password manager make unique passwords easier?
• Is multifactor authentication available?
• Are stronger authentication methods available than the ones you currently use?
• Are your recovery email addresses and phone numbers current?
• Do you know where your recovery codes are?
• Are old trusted devices still associated with your accounts?
• Do any important services offer passkeys?

You do not have to change everything today.

Start with the accounts that could unlock other parts of your digital life.

We Are Learning Authentication

This topic began with passwords, but notice where it took us.

We encountered password hashing.

Salts.

Cryptography.

Authentication factors.

Authenticator applications.

Hardware security keys.

Biometrics.

Passkeys.

Account recovery.

These are not isolated technologies.

They are different approaches to answering the same fundamental security question:

How can a system establish that you are really you?

The Password Is No Longer the Whole Security System

Passwords are not disappearing overnight.

We will probably continue using them for years.

But they no longer need to stand alone.

Password managers make strong unique passwords practical.

Multifactor authentication creates another barrier when passwords are stolen.

Biometrics can help protect credentials stored on our devices.

Passkeys can eliminate the reusable password from some authentication processes entirely.

And good recovery procedures help make sure stronger security does not lock us out of our own digital lives.

The goal is not to create the most complicated login possible.

The goal is to make authentication easy for the legitimate user and difficult for everyone else.

That is what good security should do.