How reusing one password puts your entire digital life at risk

I would like everyone to stop reusing passwords. I have been saying it for a decade and I understand perfectly well why people do it, so let me explain the specific mechanism rather than just repeating the instruction.

What actually happens

A company you signed up to years ago is breached. Not your bank, not your email. Some forum, some retailer, some service you forgot existed.

The attackers now have a list of email addresses and passwords.

They do not attack that company further. They take the list and try those combinations, automatically, across hundreds of other sites. Banks, email providers, shopping sites, social media.

This is called credential stuffing and it is almost entirely automated. Nobody is targeting you. A machine is trying your combination everywhere.

If you used the same password on your email, they now have your email. And email is the master key, because every other account has a reset link that goes there.

That is the chain. One forgotten forum to your email to everything.

Why small variations do not help

Adding a number, or the site name, or an exclamation mark, feels like a different password and is not.

The tools that process these lists apply transformation rules automatically. If your password is the same word with a different digit on the end, it is tried.

Human patterns are predictable and the attackers have millions of examples to learn the patterns from.

The three accounts that matter most

Not all accounts are equal. If you do nothing else, secure these three.

Your primary email. Everything resets through it.

Your phone account with your carrier. Control of your phone number means control of text message codes, and a SIM swap is how a lot of serious account takeovers happen.

Your password manager, if you use one.

Everything else is recoverable if those three are safe.

What to actually do

Use a password manager. This is the answer and there is not a better one.

It generates a long unique password for every site and remembers them, so you remember one strong passphrase and nothing else. The major ones are free or inexpensive, and several are built into the browsers and phones people already use.

The common objection is putting all your eggs in one basket. The alternative is the same egg in every basket, which is what most people are doing now.

Turn on two factor authentication everywhere that offers it, starting with those three accounts. An authenticator app is better than text messages, because text messages can be intercepted through a SIM swap. Any second factor is better than none.

Check whether your addresses appear in known breaches. Free services exist for this and most password managers now flag it automatically. It is a useful shock.

Where to start if this feels like too much

Do not try to fix a hundred accounts this evening. People start, get overwhelmed, and stop.

Do this instead. Tonight, change your email password to something long and unique, and turn on two factor on it. That is one job and it removes most of the risk.

Then over the next month, whenever you log in to anything, change that password before you leave. Spread across normal use it is painless and within a few months the important ones are done.

On passphrases

If you will not use a manager, use passphrases. Four or five unrelated words are far stronger than a short password with symbol substitutions, and far easier to remember.

Length beats complexity. That has been true for years and the advice most people were given fifteen years ago, about mixing symbols and changing passwords every ninety days, has been formally walked back by the standards bodies that recommended it.

Please just use a manager though.