Securing Online Accounts: Passwords, MFA, and Identity Hygiene
Introduction
Authentication is the front door to your digital life. If an attacker picks the lock (guesses your password) or steals the key (phishing), they own your data. Most account compromises today don’t happen because of “hacking” in the movie sense—they happen because of reused passwords and weak entry points.
This guide aligns with the latest NIST 800-63B guidelines to help you build an authentication fortress.
Core Concepts
1. Entropy (Password Strength)
Length beats complexity. A password like Tr0ub4dor&3 (28 bits of entropy) is easier for a computer to crack than correct horse battery staple (44 bits), yet harder for a human to remember. Modern advice focuses on long “passphrases” or ideally, totally random strings managed by software.
2. Multi-Factor Authentication (MFA)
MFA requires three types of evidence:
- Something you know (Password)
- Something you have (Phone, Hardware token)
- Something you are (Biometrics)
MFA prevents 99.9% of automated attacks. If a hacker steals your password, they still can’t get in without the second factor.
Threat Model Considerations
Who this protects you against:
- Credential Stuffing: Bots trying leaked user/pass combos from other breaches on your accounts.
- Phishing: Attackers who trick you into revealing a password.
- SIM Swappers: Attackers who bribe carrier employees to hijack your phone number (relevant for SMS 2FA).
Who this DOES NOT protect you against:
- Session Hijacking: If malware on your device steals your “session cookie” after you log in, MFA is bypassed.
- Real-Time Phishing Proxies: Advanced phishing sites (e.g., Evilginx) can relay MFA codes in real-time. (Only FIDO hardware keys stop this).
Practical Steps
1. The Hierarchy of 2FA Methods
Not all 2FA is created equal. Upgrade according to this ladder:
- Hardware Key (Best): YubiKey, Titan Key. FIDO2/WebAuthn standard. Physically un-phishable.
- Authenticator App (Good): Aegis (Android), Raivo/Ente (iOS). Uses TOTP standards.
- SMS / Email (Weak): Vulnerable to SIM swapping and interception. Only use if no other option exists.
2. Use a Password Manager
The human brain is not designed to remember 50 unique, 20-character random passwords.
- Bitwarden / Vaultwarden: Open-source, audited, and free.
- KeePassXC: Local-only (offline) file storage for maximum control.
- Rule: Every single account must have a unique, random password.
3. Recovery Codes
When you set up MFA, you receive “backup codes”.
- DO NOT save these in a text file on your desktop.
- DO print them out or save them to an encrypted USB drive kept in a fireproof safe. These are your only way back in if you lose your phone/key.
Common Misconceptions
| Myth | Reality |
|---|---|
| “I should change my password every 90 days.” | Outdated. NIST now recommends against periodic rotation because it causes users to choose weaker patterns (Winter2024 -> Spring2024). Only change passwords if you suspect a breach. |
| “Biometrics are safer than passwords.” | Biometrics are “usernames,” not secrets. You leave your fingerprints on everything you touch. They are convenient, but cannot be changed if compromised. |
Verification Steps
- Check Password Strength: Use an offline tool like
zxcvbn(or the meter in Bitwarden) to test your master password’s entropy. - Phishing Test: Visit a safe testing site setup by security researchers (e.g., verified WebAuthn demos) to see how hardware keys physically refuse to authenticate on fake domains.
- Breach Monitoring: Sign up for Have I Been Pwned alerts to know instanty when your email appears in a data dump.
References
- NIST Special Publication 800-63B: “Digital Identity Guidelines”
- OWASP: “Authentication Cheat Sheet”
- Krebs on Security: “The difficulty of securing SMS 2FA”