Passwords, passkeys and MFA

Current guidance from the US National Institute of Standards and Technology (NIST SP 800-63B) favours length over complexity. It advises services not to force arbitrary symbol rules or regular password changes, and to check new passwords against lists of known breached passwords.

The biggest risk is reuse. When one site is breached, attackers try the same email and password everywhere else. A password manager makes a unique password for every account practical.

Multi-factor authentication (MFA) stops most account takeovers that rely on a stolen password. The US Cybersecurity and Infrastructure Security Agency (CISA) points to phishing-resistant MFA, such as security keys and passkeys based on FIDO standards, as the strongest option.

Authenticator apps are a solid step up from text messages. SMS codes are better than nothing, but they can be intercepted or redirected, for example through SIM swapping.

Your email account can reset almost every other account, so secure it first. Ask your mobile carrier about an account PIN or port-out protection to make SIM swapping harder.