It’s #PasswordDay (you didn’t forget, did you?). Shelter-in-place means people everywhere are signing up for dozens of new apps and sites, and that means dozens of new passwords, so I wanted to bust some myths and share some knowledge on how to use passwords safely. 1/
Passwords are the best and the worst of things. They’ve worked from time immemorial. Centuries before computers, passwords were used by Roman armies to identify allies and prove loyalties. 2/ 
The first computer passwords were from the 60s at MIT to protect researchers on shared systems. Back then, computers were the size of minivans, people had access to at most one of them, and the threat model was an officemate who wanted to play text adventure games 3/
Fast forward to the 90s and people start having 100s of online accounts that can be signed in to from anywhere. Now the threat model isn’t that pal with local access, it’s anyone anywhere on the Internet. But most advice on passwords hasn’t evolved from that '60s threat model 4/
Strong passwords do improve security under certain circumstances. But they’re also terrible for a few reasons.
5/
5/
A) A password is just a piece of knowledge, so anyone who knows it can use it just as effectively as you. Ali Baba overheard someone say “Open Sesame” and pwned the thieves' cave. In a world of credential dumps and phishing, we’re all vulnerable to that same attack. 6/
B) In theory they’re hard to guess and the more numbers and symbols the better, but in practice people reuse things they’ll remember. Cleverly swapping ‘$’ and ‘5’ instead of ‘s’ does nothing for phishing or credential breaches, as @haveibeenpwned blogs all the time. 7/
C) Humans are trusting, busy, distracted souls, and NOBODY is immune to phishing. Particularly during pandemic work-from-home, there’s no way to “beware of suspicious links” when the baby’s crying, your boss is pinging you, and an urgent message shows up from your "bank" 8/
In the movies, Neo hacks into your mainframe; in real life, hackers exploit our trusting human nature: smbc-comics.com/index.php?db=c… 9/
So on to the password myth-busting:
10/
10/
Myth: Sites should automatically sign you out after a few minutes of inactivity. 11/
Busted: The more often you type a password, the more desensitized you get to doing it, so the more likely you'll muscle-memory it into a phishing page.
Better to use a PIN/face/fingerprint to guard against household hackers, but keep your sites and apps signed in 12/
Better to use a PIN/face/fingerprint to guard against household hackers, but keep your sites and apps signed in 12/
Myth: You should change your passwords every few months for the best protection.
13/
13/
Busted: When people are constantly asked to change their pwds, they reuse old ones or simple permutations (Str0ngPa$$1, Str0ngPa$$2, etc). They’re also more likely to use something easy to memorize (thus easy for hackers to guess). Yes, you can tell your IT team I said that 14/
Myth: You should never write your password down. 15/
Busted: Unless your principal fear is someone with access to your wallet, the larger threat is all the world’s hackers vs. a reused password. Protect against local threats with a PIN/fingerprint, and use a PASSWORD MANAGER to automatically fill strong, unique pwds. 16/
In fact, let’s close out #PasswordDay with that advice: If you do one thing to secure yourself, please start using a password manager. Nothing else provides such security gains while reducing effort. No, really: Go set up a password manager! 17/
We’ve been putting a lot of effort into the built-in @Android, @GoogleChrome, and passwords.google.com features for all our users, but there are many commercial options out there as well. @lilyhnewman and @dangoodin001 have reviewed a bunch. 18/
Our studies show that people who use pw manager apps are more secure overall: They verify you're on the real site, they generate unique pwds, and features like Password Checkup will even alert you if your pwd is breached or leaked on the dark web. blog.google/technology/saf… 19/
We’re working hard to replace passwords overall (let's talk about Webauthn and OpenID Connect soon), but today passwords are everywhere and password managers are the best way to make them secure. Stay safe and stay healthy everyone. #passwordday /fin
