Passwords, managers, and 2FA

Why it matters

Most account takeovers do not involve clever hacking. They happen because someone reused a password that leaked from another site, chose one that is easy to guess, or typed it into a fake login page. In technical jobs your accounts often reach code, cloud resources, lab systems or customer data, so a takeover hurts more than you. Two tools fix most of the problem: a password manager and two-factor authentication (2FA).

The core problem: reuse and guessability

When a website is breached, attackers often get a list of email addresses and passwords (or password hashes they can crack). They then try those same pairs on email, banking and work sites. This is called credential stuffing, and it works because people reuse passwords.

A strong password is:

• Unique: used on one site only. This matters most.
• Long: length beats clever symbols. A random passphrase of four or more unrelated words, or a generated string of 15+ characters, is far harder to guess than P@ssw0rd!.
• Not personal: no names, birthdays, pets or teams.

The US standards body NIST, in its digital identity guidelines (SP 800-63B), recommends favouring length, checking passwords against known-breached lists, and not forcing regular changes unless there is evidence of compromise. Many organisations now follow that advice.

Nobody can remember dozens of long unique passwords. That is the job of a password manager.

Password managers

A password manager is an encrypted vault for your passwords. You remember one strong master password (or unlock with your device's fingerprint or face); the manager remembers the rest.

What it does for you:

• Generates long random passwords for each site.
• Fills them in automatically, but only on the real site's domain. If you land on paypa1-login.com, it will not offer your PayPal password, which is a useful phishing alarm.
• Syncs across your devices.
• Warns you about reused, weak or breached passwords.

Options include the managers built into your browser or operating system (Google Password Manager, iCloud Keychain / Apple Passwords, Microsoft Edge) and dedicated apps (for example Bitwarden, which has a free tier, 1Password, or KeePassXC, which is free and stores the vault as a file you control). At work, use the manager your employer provides.

Protect the vault: make the master password a long passphrase you have never used anywhere, turn on 2FA for the manager itself, and store its recovery information somewhere safe offline.

Two-factor authentication

2FA (also called multi-factor authentication, MFA) asks for a second proof besides your password: something you have (a phone, a security key) or are (fingerprint). A stolen password alone is then not enough.

Common methods, from strongest to weakest:

1. Passkeys and hardware security keys (FIDO2/WebAuthn). They are tied to the real site and resist phishing.
2. Authenticator app codes (TOTP): an app such as Google Authenticator, Microsoft Authenticator, or your password manager shows a 6-digit code that changes every 30 seconds.
3. Push approvals: tap "Approve" on your phone. Only approve sign-ins you started.
4. SMS or email codes: much better than nothing, but texts can be intercepted or a number hijacked (SIM swapping).

Recovery codes

When you turn on 2FA, most services give you a set of one-time recovery codes. If you lose your phone, these let you back in. Save them in your password manager or print them and store them safely. Coding Help works the same way: you can turn on 2FA from the Security tab of your profile, and it shows recovery codes once.

Worked example: securing your email first

Your email account is the master key: password resets for every other account go there. So start there.

1. Install a password manager and create the vault with a strong passphrase, for example four random words joined with hyphens. Never use a phrase from a song or a quote.
2. In your email account's security settings, change the password to a generated one saved in the manager.
3. Turn on 2FA with an authenticator app (or a passkey if offered).
4. Save the recovery codes in the manager.
5. Repeat for your most important accounts: work or school, bank, cloud storage, code hosting, then the rest over time.

Common mistakes

• Reusing one "strong" password everywhere. One breach exposes all of them.
• Reading a 2FA code to someone who phones you. No real support team asks for your code. That call is an attack.
• Approving a push notification you did not start ("MFA fatigue" attacks send many until you tap yes).
• Losing recovery codes, then losing the phone.
• Storing passwords in a plain text file or spreadsheet on your desktop.

Quick recap

• Unique passwords matter most; long beats complex.
• A password manager generates, stores and fills them, and helps spot fake sites.
• 2FA stops most takeovers; passkeys and authenticator apps beat SMS.
• Secure your email first and keep recovery codes safe.

Try it

Open the Do tab and set up a password manager and 2FA on one real account.