Passwords and signing in

Authentication is proving who you are. There are three kinds of proof: something you know (a password or PIN), something you have (your phone, a security key) and something you are (a fingerprint or face). Authorization comes after: what you're allowed to do once you're in.

Most stolen accounts aren't cracked by genius. Credential stuffing takes usernames and passwords leaked from one site and tries them on thousands of others, because many people reuse passwords. Password spraying tries a few common passwords (Summer2026!) against many accounts. Brute force tries every combination, which only works on short passwords.

So the rules are simple. Make each password long (a phrase of several random words is easy to remember and hard to guess; 15 characters or more is a good target) and unique to one site. Current guidance (NIST's, in the US) also says not to force people to change passwords on a schedule, only when there's a sign one was leaked, and to check new passwords against lists of leaked ones.

Nobody can remember hundreds of unique passwords, which is what a password manager is for. It makes and stores a random password for each site, locked behind one strong master password, and only fills it in on the real site, which also helps against fake login pages.

Two-factor (or multi-factor) authentication, 2FA or MFA, asks for a second kind of proof, so a stolen password alone isn't enough. A code from an app or a security key is stronger than a text message, which can be stolen by moving your number to another SIM card. Attackers also send push prompts over and over hoping someone taps Approve (MFA fatigue), so never approve a sign-in you didn't start.

Passkeys go further. Your device keeps a private key and the site only stores the matching public key, so there's no password to leak or reuse. A passkey only works on the site it was made for, so a lookalike page can't trick you out of it. Where a site offers passkeys, use them.