Most account break-ins don’t involve clever hacking. They happen because a password was guessed, reused or stolen in a data breach at some other company. Two simple tools stop the vast majority of these: two-step sign-in and a password manager. Here’s what each one does and how to get started.
Why passwords alone aren’t enough
When a website gets breached, the stolen email addresses and passwords end up for sale. Criminals then try those same combinations on email, banking and shopping sites, betting that people reuse them. If your password is one you’ve used anywhere else, it may already be on one of those lists, even if you’ve never done anything wrong.
Two-step sign-in
Two-step sign-in, also called multifactor authentication, adds a second check after your password. Even if someone has your password, they can’t get in without that second step. The federal Cybersecurity and Infrastructure Security Agency says people who turn it on are significantly less likely to get hacked.
Not all second steps are equally strong. From best to good:
- Passkeys or security keys. These use your fingerprint, face or a small USB key, and they won’t work on fake websites. Microsoft, Google and Apple are moving everyone toward these.
- An authenticator app, such as Microsoft Authenticator or Google Authenticator, that shows a code or asks you to approve the sign-in.
- A text message code. It’s the weakest option, but it’s still far better than nothing.
As we covered in our article on Microsoft phasing out text message codes, the big tech companies are retiring text codes in favor of passkeys, so it’s worth moving up the list when you can.
Where to turn it on first
- Email. Whoever controls your email can reset the password on almost everything else.
- Banking and credit cards.
- Your Microsoft, Google or Apple account.
- Shopping sites that save your payment information.
- Social media accounts.
Look for a setting called two-step verification, two-factor authentication or sign-in security, usually under your account’s security settings.
A password manager
Nobody can remember a different strong password for dozens of accounts, and that’s exactly why people reuse them. A password manager solves this. It remembers your passwords for you, creates strong new ones when you need them, and fills them in automatically.
- You only need to remember one strong password, or unlock it with your fingerprint or face.
- Every account gets its own password, so one breach doesn’t open the door to the rest.
- It only fills in passwords on the real website, which helps protect you from fake sign-in pages.
Your phone and web browser likely have one built in, and dedicated password managers add features like sharing passwords safely with family or staff. Whichever you use, protect it with two-step sign-in too.
For businesses
Two-step sign-in should be required on every staff email account, along with anything that holds customer or financial information. For Microsoft 365, it’s included at no extra cost. A business password manager lets staff share accounts safely and lets you remove access the moment someone leaves, instead of passing passwords around in emails or spreadsheets.
We can help
We can turn on two-step sign-in for your accounts, set up a password manager for you or your team, and help move your passwords over. If we manage your Microsoft 365, we make sure two-step sign-in is required for everyone. Call us at (856) 566-1300 or send us a message to get started.