Authentication

If your password is too short or contains dictionary words, places, or names, it can be easily cracked through brute force or guessed by someone. The easiest way to make a strong password is to make it long (15+ characters). Consider using a 'passphrase' of multiple words, or use a password generator to create a long, strong, random password. Try this tool to see how quickly your passwords can be cracked.

If someone reuses a password and a site they have an account with suffers a leak, a criminal can easily gain unauthorized access to their other accounts. This is often done through large-scale automated login attempts, known as Credential Stuffing. Files with email addresses and their passwords having millions of records are available online. It’s easy to prevent—just use a unique password for each account.

It is impossible for human to remember hundreds of strong and unique passwords. A password manager is an application that generates, stores, and auto-fills your login credentials. All your passwords are encrypted with one master passphrase, which you must remember and keep strong. Most password managers have browser extensions and mobile apps, so your passwords can be auto-filled on any device. 1Password is recommended by EF, and as a member you would get 1Password Families subscription.

While there may be times when you need to share access to an account with another person, you should generally avoid doing so, as it makes the account more vulnerable. If you must share a password—such as when working on a team—it should be done using features built into a password manager. By creating a vault in 1Password, you can share credentials only with those you choose, rather than exposing them to the entire internet.

2FA is where you must provide both something you know (a password) and something you have (such as a code from your device) to log in. This means that if anyone has your password, they still will not be able to access your account. It's easy to get started. Download an authenticator app onto your phone, then follow the steps for each account to enable 2FA and add it to the authenticator. Next time you log in on a new device, you will be prompted for the code displayed in the app on your phone (it works without internet, and the code usually changes every 30 seconds).

When enabling multi-factor authentication, opt for app-based codes or a hardware token (Yubikey). SMS is susceptible to a number of common threats, such as SIM-swapping and interception. Your phone number is a public identifier and should not be used for authentication purposes. From a practical point of view, SMS only works when you have a signal and can be unreliable. If a bank website or payment service requires using an SMS number, consider purchasing a second prepaid secret phone number only used for account recovery in these instances.

The most secure way to authenticate is a U2F/FIDO2 security key such as Yubikey. This is a device that you connect while logging in to an online service to verify your identity. It brings several security benefits, since the browser communicates directly with the device and cannot be fooled as to which host is requesting authentication. Please follow the EF Hardware Security Keys Guidelines to proceed with getting and setting up your security keys. Read more opinion why this is so important.

When you enable multi-factor authentication, you will usually be given several codes that you can use if your 2FA method is lost, broken, or unavailable. Keep these codes somewhere safe to prevent loss or unauthorized access. You should store them on always offline device, paper, or in an encrypted file. Don't store them in your primary password manager, as 2FA and passwords must be kept separate. By merging them you defeat the entire purpose of second factor in the authentication process.