Session 3: Passwords & Account Security

Understanding the attack tells you what to defend against, and the reality is different from the common belief. Guessing and dictionary attacks work against weak passwords — 'password', '123456', names, dates — and against predictable patterns like capitalising the first letter and appending a year. Automated tools test billions of candidates, so a short or patterned password falls quickly.

But the most common real-world failure is not cracking at all: it is reuse. Attackers buy lists of email-and-password pairs leaked from breached services and simply try them everywhere — a technique called credential stuffing. If you use the same password on a forum that was breached in 2019 and on your bank, the forum breach becomes a bank breach. This is why uniqueness matters more than complexity, and it is the single most important idea in this session.

The third vector is phishing, where you hand the password over believing the site is genuine, and the fourth is malware on an infected machine capturing what you type. Note that neither is defeated by a stronger password, which is why the earlier session's two-factor and URL checking matter alongside this one.

The traditional advice — mix capitals, symbols and numbers, change it often — was based on a model of attacks that is largely obsolete, and it produces passwords that are hard to remember and easy to write down. What actually resists cracking is length, because each additional character multiplies the search space rather than adding to it. A twenty-character passphrase of ordinary words is vastly harder to crack than an eight-character string of symbols, and it is far easier to remember.

So the guidance is: let the password manager generate long random passwords for every account, and never construct them yourself. Where you must memorise a secret — the manager's master password, or a device login — use a passphrase of several unrelated words, which is both long and memorable. 'correct horse battery staple' is the classic illustration, and the principle holds: unrelated words, several of them, no personal information.

And stop changing passwords on a schedule. Forced rotation produces predictable variations — the same root with an incremented number — which is weaker than one strong password kept indefinitely. Change a password when there is a reason: a breach, a suspicion, or a shared secret that should no longer be shared. Otherwise leave it.

A password manager stores an encrypted vault of credentials, unlocked by one master passphrase, and fills them into sites automatically. It solves three problems at once: you can have a unique strong password everywhere because you never need to remember any of them; it autofills only on the correct domain, which is a genuine phishing defence because a fake site will not trigger it; and it can generate, audit and warn you about reuse.

The master passphrase is now the single most important secret you hold, because it protects everything. Make it a long passphrase of unrelated words, memorise it, and never use it anywhere else. Enable two-factor on the vault itself. And make sure you have a recovery path — most managers provide an emergency kit or recovery key, and losing the master with no recovery is unrecoverable by design.

Choose a reputable manager and enable its sync so your phone and computer share the vault, because a manager you do not have with you will not be used. The common objection — 'putting all my passwords in one place is risky' — inverts the real situation: your passwords are already all in one place, in your head, protected by the weakest of them. A manager makes them all strong and encrypts them at rest.

An audit is concrete work, not a worry. Start with the manager's built-in audit, which flags reused and weak passwords, or work through your accounts by importance. The order is: primary email first, because it resets everything else; then banking and payment; then social accounts, which are targets for impersonation fraud against your contacts; then business accounts if you have them; then everything else over time.

For each account, generate a new unique password in the manager, and enable two-factor where available. Where an account does not support a manager, use its own generator. Expect this to take an hour or two spread over a few sittings — that is normal, and it is a one-time cost that removes the entire category of credential-stuffing risk permanently.

Then check whether your email appears in known breaches. Services such as Have I Been Pwned will tell you, and a hit is not a disaster but it is information: change that password everywhere it was used, and assume anything protected by it should be treated as compromised. Being told you were breached is far better than discovering it through a drained account.

Small businesses have additional exposures that individuals do not. Shared passwords — one login written on a note and used by everyone — mean you cannot tell who did what, you cannot revoke access for one person without changing it for everyone, and a departing employee keeps working access indefinitely. That last point is a genuine and common problem: staff leave with the social media login, the email password, or the bank app still installed on their phone.

The fixes are practical. Give each person their own account wherever the service supports it, so access can be revoked individually. Where a single account is unavoidable, store it in a shared vault in a password manager rather than on a note, and change it when someone leaves. Use two-factor on every business account, and make sure the recovery details belong to the business owner rather than to a member of staff who might leave.

Then apply the same discipline to devices: a machine leaving the business should have its accounts signed out and its data wiped, and staff should not be logging into business accounts on personal machines they control. None of this is sophisticated; it is the ordinary hygiene that most small businesses have never done, and doing it puts you ahead of nearly all of them.