Account security - email, passwords and the second factor
Why email is the master key to your whole digital life, how one leaked password opens the rest, and what to do about it in practice.
The password to the Louvre’s video surveillance system was - according to investigations after security incidents - the word “Louvre”. Cracking a password like that needs neither powerful computers nor complex mathematics. It is an extreme case, but the problem is widespread: weak and reused passwords remain the cheapest way in for an attacker. Let’s close that gap.
Email is the master key
Whoever controls your email controls everything else. Through “forgot your password?” they reset access to your bank, social media, government services - it is all tied to email. Once in, an attacker can quietly read your mail, redirect correspondence, and take over your other accounts one by one.
So email is account No. 1 by protection priority:
- a separate, never-reused password - stronger than all the others;
- two-factor authentication (2FA) - the single most important step;
- periodic review of active sessions - most services show recent logins; sign out of other people’s devices;
- do not attach recovery addresses you rarely check - a forgotten backup mailbox becomes a bypass route.
A weak password cracks in seconds
123456, qwerty, password, a name with a birth year - these are the top
lines on the attacker’s list. Personal information (date of birth, a pet’s name)
is easy to find in your own social media, so a “complex-looking” Maxim1990 is
no better than 123456.
What matters is length, not “complexity”. Why length multiplies the brute-force time by orders of magnitude, and the character set does not, is covered separately in the article on GPU password brute force; how to build a strong passphrase to the modern standard is in the article on the NIST guidelines. In short: a long phrase of unrelated words beats a short string of special characters.
One password for everything - and everything falls
A reused password is not a convenience, it is the biggest hole. Hackers buy databases of leaked passwords and automatically try them on other sites - this is credential stuffing. If your password from a hacked forum matches your email password, your main account is already at risk, and you don’t even know it.
What to do:
- a unique password for every service, without exceptions;
- check your addresses on Have I Been Pwned - to see whether they are in any leaks;
- keeping dozens of unique passwords in your head is impossible, so - a password manager (Bitwarden, 1Password): it generates and stores them for you, and incidentally makes life harder for keyloggers, since you don’t type the password by hand.
The second factor saves you even with a stolen password
MFA (multi-factor authentication) is confirming a login through a second channel: a code from an authenticator app, a hardware key, or - the worst option
- SMS. The point is simple: even with the correct password, an attacker can’t get in without the second factor.
Priority by reliability: hardware key (FIDO2) → authenticator app → SMS. SMS is better than nothing but vulnerable to SIM swapping. Turn MFA on everywhere it is offered, and above all - on your email.
Takeaways
- Email is account No. 1: a separate password and 2FA are mandatory.
- Length matters more than “complexity”; personal information in a password is a gift to the attacker.
- One password across several services means a breach of one opens the rest (credential stuffing). Uniqueness - through a password manager.
- MFA covers even a compromised password. Turn it on everywhere.