You have a strong password. Here’s why your online accounts are still at risk

Raise your hand if you have used Have I Been Pwned to spot yourself in an online breach. Raise your other hand with me if you’ve actually spotted your email or password there at least once 🙋‍♂️.

With every single service requiring you to enter your email or phone number to authenticate yourself, we have all been in a situation where our credentials have leaked — I can bet more than once. While we place disproportionate weight on unique passwords, they make up only a third of your digital security stack.

Sure, passwords play a very critical part in online account authentication, but that doesn’t mean the other two components deserve any less attention. For a bulletproof digital existence, you’ll have to pay equal consideration to your email, password, and two-factor authentication, and here’s how you can achieve it.

Your primary email address is your digital identity card, but for some reason, we don’t care for it enough. We tend to hand it out to every other online portal without a second thought. But the fact is that it needs to be kept a secret almost as much as your password, if not more. You might wonder how on earth you could keep your email address a secret when you have just one (or, at most, a handful) of them. How else would you sign up for services or let people reach out without handing them your email?

The answer lies in this little-explored product called email aliases. They are often randomized email addresses that forward any incoming email to your main address without ever revealing it. So you only give others your alias while your primary account stays hidden, saving you from email scams and data leaks. In case a service is affected by a data breach, and your email alias associated with it leaks, you can simply disable that alias and create a new one with just a couple of clicks.

Email addresses are perhaps more vulnerable because they don’t get the same secrecy privileges as passwords and are usually handed out in plain text. Moreover, your primary email address is quite hard to replace given the amount of work it would take to replace it on every single account you’ve used it on. It becomes even more important to safeguard it, and thankfully, there are quite a few email alias services, like SimpleLogin and DuckDuckGo, that let you hide a critical part of your credentials without making security a burden.

Doing this will solve the most overlooked part of the equation — but we shall not stop just yet.

If emails are a lock, passwords are its key. As always, they still matter, perhaps the most, but not anymore in the way they used to. Online services have pestered us into creating adequately complex passwords using special characters, numbers, and both uppercase and lowercase letters. However, that complexity is of no use if we end up using the exact same password, or a slight variation of it, on every single account. It just defeats the purpose.

Password managers are something we all should be using already. These small little apps take the burden of remembering your passwords off you, and the only thing that you need to remember is a strong master password. The tool can create unique, ambiguous passwords for each of your services on the fly. And even if one of them ends up in a breach, you can be sure that an intruder won’t be able to use it to gain access to your other accounts.

Entering your passwords manually also leaves you susceptible to phishing attacks because a familiar-looking page layout or domain name can easily trick you into giving away your credentials, but password managers are much harder to con. Some modern password managers come with email alias services built in to help you directly sign up for a service with a secured email and password without needing to juggle multiple services.

And I understand if you’re overwhelmed by the mere thought of changing the passwords for hundreds of services — which is often the thing holding people back from switching to a password manager in the first place. You don’t have to take up the entire exercise in a single day. You can instead change the passwords as you log in to your services one by one, and you won’t even realize that your entire app ecosystem has been updated with unique passwords within a few weeks.

Once you have sorted your email and password, it’s time to make your accounts bulletproof with another authentication layer.

Think of 2FA as that alarm system that sounds a blaring siren if an intruder tries to pick your lock. As the name suggests, this second layer helps authenticate that it’s really you who is trying to log into the account with a one-time password, TOTP, or a physical security key. With 2FA enabled, you can stop a login attempt even if both your email and password have ended up in a breach. This not only alerts you about an attack (when you receive an OTP) but also buys you enough time to replace the password.

Physical security keys for authenticating your online accounts, like YubiKey, remain among the safest options for second-factor authentication, while a more convenient and widely available alternative is authentication apps that create unique TOTPs every few seconds for your linked accounts. My personal app of choice is Ente Auth, but you can pick any that suits your needs. Just make sure that you secure that app with a separate PIN that is different from your device PIN to avoid any risk of shoulder surfing and device theft.

And I know that SMS OTPs receive a lot of flak for being comparatively insecure, but in reality, they aren’t that bad. Having authentication OTPs sent over SMS is much better than having no 2FA set up at all. So go for whichever method works best for you; just make sure that you have one in place.

“Identity theft is not a joke, Jim! Millions of families suffer every year.”

Dwight might really be on to something here. Many of us personally know people (or ourselves are victims) who have been subjected to online attacks at least once. And the only defenses that can protect you are in your own hands. Even if a data breach happens, your login workflow should be so ironclad that it becomes nearly impossible for intruders to break into your accounts. A three-tiered security system, where everything from your email and password to your 2FA accounts is secured, ensures that bad actors don’t get enough information to piece your credentials together.

Having just one of these in place can give you a false sense of security, one that won’t be foolproof. When all three of them are set up exactly as they should be, they act as a robust fallback system — when one layer fails, the next one is there to protect you. And that’s how our accounts become significantly harder to compromise.