All posts

2 min read

Password & Account Security: Managers, MFA, and Passkeys

Protect your accounts from compromise with long, unique passwords, a password manager, multi-factor authentication (MFA), and passkeys.

Translated from Turkish with AI.

Why It Matters

Millions of leaked passwords circulate across the internet. If you reuse passwords across multiple services, a single breach hands attackers the keys to all your accounts.

The Fundamentals

  • A strong password is long and unique. Rather than a short, complex password, a passphrase of at least 14–16 characters is much stronger and easier to remember: mavi-bisiklet-yağmurda-çay-içer.
  • A unique password for every account. You cannot memorize all of them—and you shouldn't have to.
  • Password managers (such as Bitwarden, KeePassXC, or your phone's built-in manager): Store all your credentials in an encrypted vault, requiring you to remember only a single master password. They also provide phishing protection by refusing to autofill credentials on fraudulent domains.
  • Multi-factor authentication (MFA): A second layer of verification beyond your password—such as an authenticator app code, a hardware security key, or biometric verification. While SMS codes are better than nothing, they remain the weakest method.
  • Passkeys: The modern alternative replacing traditional passwords. Your phone or computer stores a cryptographic key that responds only to the legitimate website, making credential phishing virtually impossible. Use them whenever supported.

Account hygiene. Close unused accounts, keep recovery email addresses and phone numbers up to date, and take "Was this you?" security alerts seriously. You can check whether your email address has appeared in known data breaches at haveibeenpwned.com.

A Real-World Scenario

A forum Ayşe joined years ago suffers a data breach. Attackers use that leaked email and password to access her primary email account, then trigger "forgot password" resets to take over her social media accounts. Had MFA been enabled on her email, the attack chain would have failed at step one.

Action Items

  • Enable MFA on your primary email account first; it serves as the master key to everything else.
  • Set up a password manager and update the credentials for your 10 most critical accounts.
  • Never share passwords via email, messaging apps, or over the phone.

Key Takeaway: Long, unique, and protected by MFA. Always all three.

*This article is part 5 of the 14-part Cybersecurity Awareness series.* Next up: Email, web, and file-sharing security