In the last video, we explored the importance of password strength.

They should be unique, sufficiently complex, and the longer the better,

but doing this for every site and service can lead to password fatigue.

Many people just don't think it's worth the inconvenience of coming up with long,

unique passwords for everything they do.

And it inevitably leads to the breaches we discussed in our very first video.

And one of the biggest risks you can take is to reuse a password for

more than one site.

Imagine that you've created a really strong password.

You think it's nearly unbreakable, so you use it for social media,

for your email, and for your bank.

If, for example,

the social media account is breached, that password is effectively out in the open.

Many attackers can then try what's called credential stuffing, using an automated

tool to attempt the username and password breached from one site, on another.

Now those attackers can access your bank and email, so

password uniqueness is just as important as password strength.

Now that we've sufficiently explored the importance of password strength and

security, I'll introduce one of the best tools available to help you stay on top

of your passwords.

Password managers.

There are several options available, and I'll demonstrate one of the most popular,

but do make sure to find the solution that works best for you and your needs.

Let's take a look at what LastPass can offer.

The whole premise of password managers is that you no longer have to generate and

remember all the passwords in your life.

As the name suggests, LastPass just needs that final

master password to access the other passwords you've stored.

So let's log in with that one password you'll have to remember.

Now that we're logged into our password manager service,

we can go to any site that would require a password, and

the manager will recognize that it has credentials available.

I just fill in the fields like this, and I'm in.

Another super helpful feature that most password managers offer is strong password

generation.

I can choose the password length, up to 100 characters long,

as well as set some character restrictions to match the site's requirements.

I can then store this super strong password with the manager and

never have to think about it again.

Password managers are great tools because they address the convenience security

tradeoff directly.

They reduce the inconvenience and frustration that can

come from password fatigue and they up your security in the process.

They're likely better at generating strong passwords than any human would be.

Now, with a strong unique password for each site,

we're safe from credential stuffing attacks if a service ever has a breach,

but that doesn't help for the hacked site itself.

Another type of tool exists to protect your data

even if your password is out in the open, it's called two factor authentication.

It's more of a feature that you can enable for sites that support it

than it is a service you can purchase, but it is highly recommended.

Two factor auth is an additional layer of security on top of your passwords.

It is often a code that is sent to you as a text message or

generated on a device you own like your smartphone.

In fact you likely already use it in your life without realizing it.

It's the reason you carry an ATM card and use a PIN.

This is how two factor auth often is used for your online accounts.

You log into a site with your username and password.

The site then prompts you again to enter a code.

That code is either texted to you or better yet you have set up a special app

on your phone that generates these codes for you every ten or so seconds.

You enter that code and now you're logged in.

It's a little extra effort up front, but

two factor authentication is an incredibly effective security mechanism.

Your data is safe even if your password was leaked or

even if you were tricked by a phishing scam.

I'd like to offer a few additional notes about password managers,

email, and security questions.

Password managers store your secrets, which make them prime targets for hackers.

Make sure that you are comfortable with that level of trust, and you still need to

be extra cautious with that final password used to log into the password manager.

Another security concern to think about is

that your email is often used as your personal identity.

If you lose access to your email or it's compromised in some way,

many sites offer password recovery or reset through your email.

Your email account would be an ideal place

to start enabling two factor authentication for this exact reason.

As another mode of password reset and recovery, and even sometimes as a limited

form of two factor authentication, sites will ask you security questions.

They're meant to be questions that only you would know and

would have the answers readily available, but

would prevent strangers from attempting to take over your account.

This may have been effective in the past, but choosing the right questions and

answers can often be harder then generating a strong password.

And with questions like what is the name of the high school you went to,

the answers can often be easily found on a person's social media profile.

So be mindful of these questions.

And when available, we should all be moving to more secure two factor options,

like the cogenerating apps on our smart phones.