Strong passwords and two-factor authentication

The ladder everyone is already standing on

Account security is not a binary you either have or do not. It is a ladder, and everybody is standing on one of its rungs right now. The bottom rung is one password reused across several sites. The top rung is a passkey, where there is no password to steal at all.

Looking at it this way has one practical benefit. Someone who thinks they have to fix everything in one night usually does nothing and stays where they are. Someone who climbs one rung is better off tonight than they were last night.

The order of the rungs is not arbitrary either. A reused password is the worst case, worse than a short one, and the reason has nothing to do with the strength of the password itself. A reused password means the security of your account is tied to the weakest site you ever signed up to; that old forum nobody has updated in years, whose user list spills out one day. On that day your password stops being a secret, and nobody had to break anything.

The second rung is uniqueness, the third is length, and after that comes the tool that makes uniqueness possible. A password manager does not replace the second rung; it is what makes the second rung achievable, because no human being memorises seventy unique passwords.

Then, after the password, the second layer. Two-factor authentication means that even if the password leaks, the leak on its own is not enough. That sounds simple, and the entire value of this lesson sits in it: arrange things so that one mistake is not your last one.

Why length matters more than complexity

For years everybody was told a password needs upper case, lower case, a digit and a symbol. The result was passwords that humans struggle to remember and computers do not struggle to break, which is the worst possible combination. P@ssw0rd! is exactly the pattern any guessing list tries first.

The arithmetic behind it is simple. Every character you add to a password multiplies the number of possible combinations by the size of the alphabet. Adding one symbol to an eight character password only makes the alphabet slightly bigger. Adding four more characters makes the whole space larger by orders of magnitude. Length always wins, and that is only true when the guessing is blind; if the password is built from a familiar pattern, none of this arithmetic applies at all.

This is not our opinion. The NIST SP 800-63B guideline, the authentication standard of the American government, states three things outright, and all three are the opposite of what most Iranian sites enforce: the minimum length for a password used as the only login factor is 15 characters, and 8 when the password sits next to a second factor; a service is not allowed to force a mixture of character types; and it is not allowed to make users change passwords on a schedule, unless there is evidence of compromise.

One point usually gets dropped, and it matters: that document places requirements on the service, not on you. It does not say your password must be 15 characters; it says a site you log into with a password alone has no business accepting less than 15. The user-facing conclusion is safe to draw anyway: where you have no second factor, a short password is not enough.

The practical route to length is a passphrase. Four or five unrelated words that only you put side by side clears twenty characters easily, and it is easier to remember than a cluttered eight character password. There is one condition: the words have to be genuinely random. A line of poetry or a proverb, however long, is already on the lists.

Password managers, without the sales pitch

A password manager is a program that keeps passwords encrypted and opens with one master password. What it actually does is not to make passwords secure; it is to turn uniqueness from a wish into a daily routine. As long as passwords have to be memorised, people reuse them, because they have no other option.

Now the other side, the one salespeople skip. A password manager creates a single point of failure. Everything goes behind one master password, and if that one leaks, all of them leaked together. That objection is real, and answering it with do not worry is meaningless.

Three things make the objection bearable, and all three are needed. First, the master password has to be a long passphrase used nowhere else. Second, two-factor authentication has to be on for the manager itself; that is the next section, and here it matters more than anywhere else. Third, you need to know what happens if you forget the master password. In most of these programs the answer is that nobody can help you, because the company does not have your master password either. That is a feature, not a flaw, but you want to know it before the day it applies.

Our position is simple: a password manager, with all of the above, is safer than where most people are now, because where most people are now is one password across seventy sites. But if anybody tells you a manager reduces the risk to zero, they are selling something.

One last point that rarely gets said: the manager built into your browser, with all its limits, is far better than reusing a password. The which product debate only means anything once you have climbed the second rung. If you have not, whichever one you will genuinely use tonight is the best one.

Which kind of two-factor is actually stronger

Turn on two-factor authentication is a correct sentence that tells half the story. The four common kinds are not equally secure, and the gaps between them are not small.

SMS is the weakest. The same NIST guideline quoted above keeps a list of restricted authenticators, and in the revision we read it has exactly one member: using the telephone network to deliver a code. So out of every method there is, the standards body has marked precisely this one. The reason is that your phone number is itself another account, held at your operator, and it can be moved.

An authenticator app code, the six digits that change every thirty seconds, is a rung higher. Nothing travels over the phone network and the code is generated on the device itself. But it has a structural weakness that rarely gets said out loud: the code is readable and replayable. If you type it into a fake page, whoever built that page can type the same code into the real site within the same thirty seconds. The app has no idea where you are.

Push approval, the yes it is me prompt, is close to app codes in strength but adds a human weakness: when the prompts keep coming, people get tired and approve one out of irritation. Wherever the service offers the variant where you pick a number shown on screen, choose that one; it removes the thoughtless approval.

Hardware keys and passkeys are a different kind of thing, and the difference is not simply stronger. These bind to the address of the site. NIST calls the property phishing resistance and explains the mechanism: the signature the key produces is tied to the identity of the site the key is talking to, so a fake page receives something that is worthless at the real one. This is the only family that removes the I typed my code in the wrong place problem at the root rather than making it harder.

Through all of this ranking, do not lose one sentence: SMS beats nothing. If a site offers only SMS, switch it on. This is a discussion about choosing between options, not an excuse for having none.

What a passkey is, and what it changes

A passkey builds a key pair instead of a shared password. The private half stays on your device and never leaves it; the public half is stored by the site. At login the site sends a challenge, your device signs it with the private half, and the site checks the signature against the public half. What travels between them is not a reusable secret.

Two consequences fall out of that single change and both matter. First, the site no longer holds a secret that can leak; if its database spills, the public keys are useless to anyone. Second, a fake page gets nowhere, because the signature is bound to the address of the real site. The phishing resistance from the previous section is the default here, not an extra feature.

Now the part that rarely gets said. NIST gives this family its own appendix, titled syncable authenticators, meaning keys that sync between your devices. Syncing is what makes passkeys usable, and it is also what creates a new pressure point: the security of your keys becomes tied to the security of the cloud account that syncs them. Your Apple account, your Google account or your password manager now needs the strongest protection you have.

Let us be honest about today too. Passkeys are not available everywhere, and from Iran a share of the services that do support them will not open at all. Even where a passkey is available, the old password almost always stays as a fallback, and while that fallback is open the account is still tied to the password and to the recovery path. So switch passkeys on where they exist, and keep the password behind them unique and long.

If you only have an hour, start here

Not all accounts are worth the same, and they should not be treated the same. The right order comes out of one simple question: if this account goes, what else goes with it?

The main email address comes first, with no rival. Email is where the forgot my password button of every other site ends up, so whoever holds the email holds the rest. After that, if you run a site, the domain registrar account and then the hosting control panel; they sit near the top for the same reason, not because of what they cost. Then banking and payment, then the social accounts your professional reputation lives on, then everything else.

On those first four or five, do three things tonight: make the password unique and long, switch on the best two-factor that service offers, and take the recovery codes and keep them somewhere off that device. Recovery codes are the step everybody skips and later pays for.

There is a fourth job few people mention: in the settings of each of these accounts, open the list of active sessions and connected devices and throw out anything you do not recognise. The old login of a phone you sold two years ago is still an open door.

The rest of the accounts can be fixed over the following months without hurry. What matters is that the first two are fixed tonight.