Step 1 of 6 Passwords and two-step sign-in
How passwords are guessed
When a website is hacked, criminals often steal its stored passwords in scrambled form and try to guess them on their own computers, at thousands of guesses a second. They start with the commonest passwords and words with numbers on the end, then work through every combination. Each extra character multiplies the work, so length matters most.
Try made-up passwords only, never one you really use. Nothing you type here is saved or sent anywhere.
Make up a password that would take more than a century to guess.
Which is harder to guess: P@ssw0rd! or purple tractor sandwich? Try both, then answer.
Step 2 of 6 Passwords and two-step sign-in
One key, many doors
Using the same password everywhere is like having one key for your home, your car and your office. When one small website is hacked, its passwords leak, and criminals try them everywhere else. Reusing a password is the biggest single risk.
Leak the gym website and see what happens. Then stop the leak from spreading.
How do criminals use a list of leaked passwords?
Step 3 of 6 Passwords and two-step sign-in
Three random words
A password made of three random words is long, easy to picture and hard to guess. The words must be random: names, places and years that mean something to you are exactly what attackers try first.
Choose a word for each slot. Build a password from three random words that's rated strong.
Your pet is called Bella. Why is "Bella" a poor word to use?
Step 4 of 6 Passwords and two-step sign-in
A safe for your passwords
Nobody can remember a different strong password for every account. A password manager does it for you: it creates and stores a unique password for each site, locked behind one strong master password (three random words work well). It fills them in for you, and only on the real site.
Unlock the vault, then open three accounts, each with its own key.
You land on a fake bank page (like the ones in lesson 05). Why does a password manager refuse to fill in your password there?
Step 5 of 6 Passwords and two-step sign-in
The second step
Two-step sign-in (also called two-factor authentication) adds a second lock: something you have, as well as something you know. Even with your password, a criminal is stopped without your phone or key. From strongest to weakest: a passkey or security key; a code from an authenticator app; a code sent by text message. Any of them is far better than none.
An attacker has stolen your password. Choose a second step, then let them try to get in.
Why is a text-message code the weakest of the three second steps?
Step 6 of 6 Passwords and two-step sign-in
Recovery and codes
Every account has a back door for when you forget your password: a backup email or phone, or recovery codes. Keep them up to date and private. And never share a sign-in code with anyone, however official they sound: the code is the key itself.
Your phone rings: "Hello, this is account support. We've sent you a code to confirm your identity. Can you read it to me?" What do you do?
Where should you keep your backup recovery codes?
Quiz Passwords and two-step sign-in
Check what you know
Six questions, 5 points each. One answer per question.
Done Passwords and two-step sign-in
Lesson complete
Long, unique passwords, kept in a password manager, plus a second step on your important accounts: email first, then bank, then anything that holds money or personal details. That's most of what it takes to be a hard target.
MARIFA · Nothing you do here leaves this device.