Passwords, MFA, and Password Managers

Passwords, MFA, and Password Managers

How to Stop Being the Weakest Link

Despite all the rules, "123456" and "password" remain the most common passwords year after year. Attackers exploit our laziness, our reuse of passwords across sites, and our tendency to choose pet names and birthdays. In this post, we will move beyond "make a strong password." You will learn how attackers actually steal passwords, why Multi-Factor Authentication (MFA) is your best defense, and how password managers solve the "I can't remember 100 unique passwords" problem.

1. How Attackers Get Your Password

A. Brute Force Attack

The attacker tries every possible combination. Modern GPUs can try billions of passwords per second. A simple 6-character lowercase password can be cracked in minutes. Defense: Length over complexity. A 12-character random password takes centuries to brute force.

B. Dictionary Attack

The attacker tries common words, names, and patterns: "password123," "iloveyou," "qwerty." Defense: Never use dictionary words, even with substitutions like "p@ssw0rd" – cracking tools know these substitutions.

C. Credential Stuffing

Attackers take username/password pairs leaked from one website and try them on other websites. This works because people reuse passwords. Defense: Use unique passwords for every site.

D. Phishing

The attacker sends an email that looks like it is from your bank. The link goes to a fake login page. Defense: Never click links in unsolicited emails. Type the website address manually. Use MFA.

E. Keylogging and Shoulder Surfing

Malware records your keystrokes, or someone watches you type in a coffee shop. Defense: Use a password manager so you never type passwords manually. Be aware of your surroundings.

2. Password Strength – Length Beats Complexity

A password like "P@ssw0rd!" (8 characters) is not strong. Attackers know common substitutions. A dictionary attack with rules will crack it in seconds.

The correct approach: Make it long, random, and unique. A passphrase like correct-horse-battery-staple (four random words, 28 characters) is both memorable and extremely strong. Do not use famous phrases. Use truly random words.

3. Multi-Factor Authentication (MFA) – Your Second Layer

MFA requires two or more of the following: something you know (password, PIN), something you have (phone, security key), or something you are (fingerprint, face scan). Even if a hacker steals your password, they cannot log in without the second factor.

Advice: Enable MFA on every account that offers it. Use an authenticator app or hardware key. Avoid SMS if possible.

4. Password Managers – The Only Realistic Solution

Remembering 100 unique, random passwords is impossible. A password manager stores all your passwords in an encrypted vault, generates random passwords for each site, and auto-fills login forms so you never type passwords (defeating keyloggers). You remember one strong master password and use MFA for the vault.

Popular password managers:

• Bitwarden: Open source, free tier, highly recommended for security.
• 1Password: Paid, polished, user-friendly.
• KeePassXC: Offline, open source, manual syncing.
• Apple Keychain / Google Password Manager: Built into OS, but less portable.

Common myths:

• "What if the password manager gets hacked?" The vault is encrypted with your master password. Even in a breach, attackers get encrypted blobs, not plaintext passwords.
• "Isn't all my eggs in one basket?" Yes, but that basket is much stronger than reusing passwords across 100 sites.
• "I don't trust the cloud." Use an offline manager like KeePassXC and sync the encrypted file manually.

5. How to Migrate to a Password Manager Today

1. Choose a manager: Bitwarden (free) is excellent.
2. Create an account with a strong master password (a 4-word passphrase) and enable MFA.
3. Start adding logins as you log into sites, or import from your browser's built-in storage.
4. Change passwords for critical accounts (email, banking, social media) to random 14+ character passwords.
5. Remove saved passwords from your browser to avoid confusion.
6. Back up your vault and store the backup in a safe place.

Summary

Review Questions

1. Why is "P@ssw0rd" not actually a strong password despite containing uppercase, symbols, and numbers?
2. What is the main weakness of SMS-based MFA?
3. If you use a password manager, why do you still need a unique, strong master password?