Passwords, two-factor authentication and passkeys

Rules that work

1. A different password for every service. When one leaks, the attacker tries it everywhere.
2. Length matters more than complexity. Four random words are stronger than “P@ssw0rd!”.
3. Use a password manager (for example Bitwarden, 1Password or your own Vaultwarden). You only have to remember one strong password.
4. Turn on two-factor authentication wherever you can, especially for email and banking.

The second factor

• An SMS code is better than nothing, but it can be abused by hijacking your number.
• An authenticator app (TOTP) is more secure.
• A security key or passkey is the most secure, because it cannot be tricked by a fake website.

Passkeys

A passkey is a cryptographic key stored in your phone or password manager. You sign in with your fingerprint or face. There is nothing to give away or to be stolen by phishing, because the key only works on the service's real domain.