Guidebolt

Account Security

2018.03.27

Overview

Account security always incurs a trade-off between safety and convenience. That said, certain strategies can help you achieve a great balance between both factors.

Password Hardening

Strong and convenient passwords are long yet memorable and easy to type. You don't need the scrambled strength of "A2B2C3D6" when you can use a longer phrase like "OpticalBattleshipsForYou" which is tentatively stronger and much more intuitive.

For greater strength, consider a full sentence like "SplinterItIntoAThousandPiecesAndScatterItIntoTheWinds".

Multi-Factor Authentication

Because passwords can be guessed or discovered, it is worth having extra steps to the login process, which usually involve a security question or mobile text message.

In the case of a security question, you can improve the hacking difficulty by saving the answer separately from the password or even storing the answer only in physical form. For greater security, you could simply keep the answer in your mental memory, but in that case you absolutely need to protect against memory loss and forgetfulness by preparing a way to otherwise recover the answer or reset your security questions.

In the case of a mobile text message, your phone or its network would have to be compromised in order for a hacker to complete the login process.

Multiple Accounts

Modern accounts are usually recoverable with a master email address. That email is a single point of failure that jeopardizes all connected accounts. Thus it can be worth using multiple accounts with different emails to split the damage of a single hack.

Multiple Providers

Even if you have several accounts with strong access protection, they are still vulnerable to an attack on your service provider itself. While unlikely, even banks can suffer attacks that compromise parts of their system. Even if you knew how to erect the perfect defense, you cannot defend what you do not have control over. Thus it can be worth diversifying this uncontrollable risk by having accounts with multiple service providers.

Note that you actually do have one concrete way to mitigate provider risk, which is to select the provider that is least likely to become compromised.