Learn about password best practices—as well as a solution that could simplify your security and user experience.
The weakest link in your cybersecurity set-up may also be the most overlooked aspect: your passwords.
Think about it. When you open an account, how much time do you spend considering your password? A few seconds? Or, even worse, do you just reuse the same password for every account?
Poor password management can derail all the other security efforts you’ve made to safeguard your personal identity and financial assets. It’s similar to leaving the key in the front-door lock to your home; you’re making it far too easy for intruders to gain access. And with the average individual having 27 online accounts that require a password, your life can suddenly become much more challenging if your passwords are compromised.1
Research continues to evolve regarding password best practices in order to stay ahead of cybercriminals. While some of the following advice may sound familiar, others are based on new information.
Don’t get personal: Your job is to make life difficult for a hacker. Providing personally identifiable information (PII) in your passwords—such as your name, birthdate, home town, house number or pet’s name—that cybercriminals can uncover through public records or social media accounts gives them a head start at cracking your passwords.
Emphasize length: Generally, longer passwords are less likely to be cracked. Focus on generating passwords that are at least eight characters; even bumping them by a few more characters makes your password exponentially harder to guess.
Also, when possible consider using passphrases instead of a password built around a single word or a series of letters, characters and numerals. The passphrase should consist of at least several words. (It’s fine to use a nonsensical collection of random words.) Choose a passphrase that’s easy for you to remember, but don’t include any PII.
Use a unique password for each account: With an estimated 66% of Americans using the same password for multiple accounts, this won’t be popular advice.2 But it’s essential for your security.
Developing a password for every account limits the damage if your credentials are compromised. If you reuse passwords and a hacker steals that password, they can go on a devastating spree across multiple accounts that could wipe out your savings, max out your credit cards, hijack your social media accounts, seize your private photos, gain access to your contacts, damage your reputation and more.
Test your passwords: You might think your proposed password is airtight. But is it really? It’s best to check your password against a list of commonly used or easily compromised passwords before adopting the password. Some software tools will compare your password against previously held or exposed passwords for you.
Keep passwords confidential: In short, don’t share your passwords. That’s especially true when someone initiates a conversation with you and requests your password.
In general, keep your password as private as your PIN numbers. It’s that important.
Choose good security questions: Many service providers require you to supply the answer to a password recovery question when setting up your account. (You may need to provide the answer if you forget your password or want to change it.)
Avoid questions that hackers might be able to easily obtain or guess the answer, such as the name of your street or pet. You can also make up your own nonsensical answer to the question that no one else would guess.
Additionally, providers may provide a “hint” if you forget your password to prompt your memory. Remember that anyone who accesses your device will be able to see that same hint.
Avoid password auto-save: Computer browsers often offer to save your passwords and automatically enter them for you when you log into your accounts. It’s so tempting to take advantage of this because it speeds the log-in process and avoids taxing your busy mind.
But it’s a risky practice. If a cybercriminal hacks into your system, all your saved passwords will be available to them. And if anyone else in your household has access to your computer or phone, they’ll be able to see your passwords, too.
Enable the “show password” option: How many times have you been frustrated by being unable to see what you’re entering in the passcode field of your log-in screen because it’s disguised? Some companies now allow you to clearly view what you’re typing.
While it seems counterintuitive, making your password visible can be a good idea (when you’re in a secure environment). It enables you to catch your typing mistakes, and avoid unnecessary password resets due to mistakenly thinking you’ve forgotten your password. Resetting passwords too often leads to an increased potential of data exposure.
Be careful where/how you enter passwords: Entering your passwords on public or shared computers or when using public Wi-Fi intensifies the risk of having your passwords compromised.
If you’re forced to use a public computer, log off after your session and check to make sure the computer didn’t automatically save your password. And if you enjoy browsing your accounts while outside your home, access them through a hotspot created with your phone or a virtual private network (VPN), which provides a secure, encrypted connection instead of trusting public Wi-Fi.
Use multi-factor authentication: Applying multi-factor authentication (MFA) can strengthen your password security by protecting access to your accounts. MFA requires you to provide two or more credentials when logging into your account. Doing so makes it more challenging for hackers because they’ll need to supply more than your password to access your account.
Are you tired of keeping track of all your passwords? Exhausted by the thought of creating a unique password for every account?
A password manager might be right for you. It’s essentially a digital vault that securely creates, encrypts and stores unique, complex passwords for every account. You then only need to remember your master password for your password manager app.
Many password managers will review your existing passwords for you first, and tell you if they should be updated because they’re weak, reused or have been exposed in data breaches. (If so, they’ll generate new passwords.) Some also give you the time-saving option of auto-filling online account forms with your billing address, credit card information and other pertinent data. When choosing a password manager, look for well-regarded ones that utilize the latest security options available and will work across all your devices.
If you’re concerned about having all your passwords in one location, here are a couple of things to keep in mind. First, use MFA with your password manager for greater protection. Second, even if a hacker breaks into your vault, your information will likely be useless to them because it’s encrypted.
One final piece of advice. Although passwords managers can be a significant boost to your security and peace of mind, you still need to do your part by applying overall sound password management practices.
Jifunze kuhusu mbinu bora za nenosiri na pia suluhisho ambalo linaweza kurahisisha usalama wako na uzoefu wa mtumiaji. Sehemu dhaifu zaidi katika mfumo wako wa usalama wa mtandao inaweza pia kuwa sehemu inayopuuzwa zaidi: nywila zako. Fikiria jambo hilo. Unapofungua akaunti, unatumia muda gani kufikiria nenosiri lako? Sekunde chache? Au, hata mbaya zaidi, je, wewe tu kutumia tena nenosiri sawa kwa kila akaunti? Usimamizi duni wa nenosiri unaweza kuharibu juhudi zote za usalama ambazo umefanya kulinda utambulisho wako wa kibinafsi na mali yako ya kifedha. Ni sawa na kuacha ufunguo katika kufuli la mlango wa mbele wa nyumba yako; unafanya iwe rahisi sana kwa wavamizi kupata upatikanaji. Kwa kuwa mtu wa kawaida ana akaunti 27 za mtandaoni ambazo zinahitaji nenosiri, maisha yako yanaweza kuwa ngumu zaidi ikiwa maneno yako ya siri yameharibiwa. Ingawa baadhi ya ushauri unaofuata huenda ukasikika kuwa unawajua, mengine yanategemea habari mpya. Usiwe na ubinafsi: Kazi yako ni kufanya maisha ya hacker kuwa magumu. Kutoa habari ya kibinafsi (PII) katika nywila zako - kama vile jina lako, tarehe ya kuzaliwa, mji wa nyumbani, nambari ya nyumba au jina la mnyama - ambayo wahalifu wa mtandao wanaweza kufunua kupitia rekodi za umma au akaunti za media ya kijamii huwapa mwanzo wa kuvunja nywila zako. Fanya mkazo juu ya urefu: Kwa kawaida, ni rahisi kuvunja nywila ndefu. Jitahidi kuunda nywila ambazo zina angalau herufi nane, hata kuzidisha kwa herufi chache zaidi hufanya nywila yako iwe ngumu zaidi kutabiri. Pia, wakati inawezekana, kufikiria kutumia passphrases badala ya password kujengwa kuzunguka neno moja au mfululizo wa herufi, wahusika na tarakimu. Maneno ya siri yanapaswa kuwa na angalau maneno kadhaa. (Ni vizuri kutumia mkusanyiko wa maneno yasiyo na maana ya nasibu.) Chagua kificho ambacho ni rahisi kukumbuka, lakini usijumuishe PII yoyote. Tumia nenosiri la kipekee kwa kila akaunti: Kwa takriban 66% ya Wamarekani kutumia nenosiri moja kwa akaunti nyingi, hii haitakuwa ushauri maarufu. Kuendeleza nenosiri kwa kila akaunti hupunguza uharibifu ikiwa sifa zako zinahatarishwa. Ikiwa unatumia tena nywila na hacker anaiba nywila hiyo, wanaweza kwenda kwenye shambulio la uharibifu katika akaunti nyingi ambazo zinaweza kufuta akiba yako, kuongeza kadi zako za mkopo, kuiba akaunti zako za media ya kijamii, kuchukua picha zako za kibinafsi, kupata mawasiliano yako, kuharibu sifa yako na zaidi. Jaribu kutumia nywila yako: Huenda ukafikiri kwamba nywila unayopendekeza haifai. Lakini je, kweli ni hivyo? Ni bora kuangalia nenosiri lako dhidi ya orodha ya kawaida kutumika au kwa urahisi compromised nenosiri kabla ya kupitisha password. Baadhi ya zana za programu zitapinganisha nenosiri lako na nenosiri zilizowekwa au zilizofunuliwa hapo awali kwa ajili yako. Weka nywila za siri: Kwa ufupi, usishiriki nywila zako. Hiyo ni kweli hasa wakati mtu anaanzisha mazungumzo na wewe na kuomba nenosiri lako. Kwa ujumla, weka nenosiri lako kuwa la faragha kama nambari zako za PIN. Ni muhimu sana. Kuchukua maswali ya usalama: Watoa huduma wengi wanahitaji wewe kutoa jibu kwa swali la uokoaji wa nenosiri wakati wa kuanzisha akaunti yako. (Huenda ukahitaji kutoa jibu ikiwa umesahau nenosiri lako au unataka kulibadilisha.) Kuepuka maswali ambayo huenda hackers waliweza kupata kwa urahisi au kukisia jibu, kama vile jina la barabara yako au pet. Unaweza pia kutengeneza jibu lako la kipumbavu kwa swali ambalo hakuna mtu mwingine atakayefikiria. Kwa kuongezea, watoa huduma wanaweza kutoa "shauri" ikiwa unasahau nenosiri lako ili kukuchochea kukumbuka. Kumbuka kwamba mtu yeyote ambaye anaingia kwenye kifaa chako ataweza kuona kidokezo hicho hicho. Kuepuka kuhifadhi nywila: Mara nyingi vivinjari vya kompyuta hutoa kuhifadhi nywila zako na kuziingiza moja kwa moja wakati unapoingia kwenye akaunti zako. Ni hivyo kuvutia kuchukua faida ya hii kwa sababu ni kasi mchakato wa kuingia na huepuka kodi akili yako busy. Lakini ni zoea lenye hatari. Ikiwa mhalifu wa mtandao ataingia kwenye mfumo wako, maneno yako yote ya siri yaliyohifadhiwa yatapatikana kwao. Na kama mtu mwingine yeyote katika nyumba yako ana upatikanaji wa kompyuta yako au simu, wao utakuwa na uwezo wa kuona nywila yako, pia. Kuwezesha <unk>show password<unk> chaguo: Ni mara ngapi umekuwa kukatishwa tamaa na kuwa na uwezo wa kuona nini wewe ni kuingia katika uwanja wa password ya skrini yako ya kuingia kwa sababu ni disguised? Kampuni fulani sasa hukuruhusu kuona waziwazi kile unachokiandika. Ingawa inaonekana kinyume na akili, kufanya nenosiri lako kuonekana inaweza kuwa wazo nzuri (wakati wewe ni katika mazingira salama). Inawawezesha kukamata makosa yako ya kuandika, na kuepuka resets password zisizohitajika kutokana na kufikiri kimakosa umesahau password yako. Resetting passwords mara nyingi sana inaongoza kwa kuongezeka uwezekano wa data mfiduo. Jihadharini na wapi na jinsi ya kuingiza nywila: Kuingiza nywila zako kwenye kompyuta za umma au zilizoshirikiwa au wakati wa kutumia Wi-Fi ya umma huongeza hatari ya kuwa na nywila zako kuharibiwa. Kama wewe ni kulazimishwa kutumia kompyuta ya umma, log nje baada ya kikao chako na kuangalia kuhakikisha kompyuta si moja kwa moja kuhifadhi nenosiri lako. Ikiwa unafurahia kuvinjari akaunti zako nje ya nyumba yako, zipe kupitia hotspot iliyoundwa na simu yako au mtandao wa kibinafsi wa virtual (VPN), ambayo hutoa uhusiano salama, uliofichwa badala ya kuamini Wi-Fi ya umma. Tumia uthibitisho wa multi-factor: Kutumia uthibitisho wa multi-factor (MFA) kunaweza kuimarisha usalama wa nenosiri lako kwa kulinda upatikanaji wa akaunti zako. Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo wa Mfumo. Kufanya hivyo hufanya iwe vigumu zaidi kwa wahasibu kwa sababu watahitaji kutoa zaidi ya nenosiri lako ili kupata akaunti yako. Je, umechoka kufuatilia nywila zako zote? Je, umechoka kwa wazo la kuunda nenosiri la pekee kwa kila akaunti? Meneja wa nenosiri anaweza kuwa sahihi kwa ajili yenu. Ni kimsingi digital vault kwamba salama inajenga, encrypts na kuhifadhi kipekee, nywila tata kwa kila akaunti. Unahitaji tu kukumbuka password yako kuu kwa ajili ya programu yako ya meneja password. Wasimamizi wengi wa nenosiri watakagua nenosiri lako lililopo kwa ajili yako kwanza, na kukuambia ikiwa yanapaswa kusasishwa kwa sababu ni dhaifu, hutumiwa tena au yamefunuliwa katika ukiukaji wa data. (Kama ni hivyo, wao <unk>ll kuzalisha nywila mpya.) Baadhi ya huduma hizi pia kutoa chaguo la kuokoa muda wa kujaza fomu za akaunti mtandaoni na anwani yako ya bili, habari ya kadi ya mkopo na data nyingine muhimu. Wakati wa kuchagua meneja wa nenosiri, tafuta moja inayoheshimiwa ambayo hutumia chaguzi za hivi karibuni za usalama zinazopatikana na itafanya kazi kwenye vifaa vyako vyote. Kama wewe ni wasiwasi kuhusu kuwa na nywila yako yote katika eneo moja, hapa ni mambo machache ya kukumbuka. Kwanza, tumia MFA na meneja wako wa nenosiri kwa ulinzi mkubwa. Pili, hata kama hacker huvunja katika hazina yako, habari yako pengine itakuwa haina faida kwao kwa sababu ni encrypted. Ushauri mmoja wa mwisho. Ingawa wasimamizi wa nywila wanaweza kuwa kichocheo kikubwa kwa usalama wako na amani ya akili, bado unahitaji kufanya sehemu yako kwa kutumia mazoea ya jumla ya usimamizi wa nywila.