Passwords and account security
Account security depends on the passwords used, how they are stored and the routes available to reset them.
Unique passwords
Remembering many complex passwords can lead people to choose weak passwords, write them down or store them insecurely. In 2013, 123456 and password were the two most common passwords, while a 2012 UK study found that most adults reused passwords across multiple or all websites. Using different passwords reduces the chance that a breach at one website gives an attacker access to other accounts. Password-management measures can mitigate risk rather than eliminate it.
Three recommended account-security practices are:
- Use secure passwords everywhere.
- Use a different password for every account.
- Use two-factor authentication whenever it is available.
Memorable passphrases
A passphrase can be long and complex while remaining easy to type and remember. Easily guessed phrases, including popular quotations, film titles and song lyrics, should be avoided. Suggested approaches include inventing a lie or nonsensical sentence, joining common but unrelated words, or using a person–action–object statement. A visual image or story can help memorisation, although passphrases do not solve the separate problem of remembering which one belongs to each account.
Password managers and additional authentication
Password managers store encrypted account login information behind a master password, reducing the need to memorise every password separately. Many can assess existing password strength and generate long random passwords; some also fill forms or store identification, bank-account and credit-card information. The master password creates a single point of failure, and some managers add two-factor authentication using biometrics or a hardware device.
Reset questions
Complex, unique passwords do not protect an account if an attacker can reset them. Reset questions often ask for personal information that can be guessed or found online, such as a favourite colour or a mother's maiden name. False or counterintuitive answers can avoid that problem, but add information that must be remembered.