Skip to content
Lesson 4 of 8

Passwords and Authentication

14 min read

Authentication, Authorization, and Identity

Before talking about passwords, it helps to distinguish three concepts. Authentication answers the question "who are you?": the process of verifying a user's identity. Authorization answers "what can you do?": the permissions granted once the identity is verified. Identity management covers the entire lifecycle of accounts: creating, modifying, and removing access.

An airport analogy helps fix the difference: showing your ID at the counter is authentication (you prove who you are); the boarding pass that lets you onto a specific flight, in a specific class, is authorization (it defines what you may do). They are distinct controls, and each can fail separately: you can be exactly who you claim to be and still have no permission to enter the cockpit.

Authentication relies on one or more factors: something you know (a password), something you have (a phone or a physical key), and something you are (a fingerprint or facial recognition). The strength of an authentication system depends on how many independent factors it combines and on the quality of each one. Watch the word "independent": a password plus a security question are two things you know — that is one factor repeated, not two factors.

| Factor | What it is | Examples | Typical weakness | |---|---|---|---| | Something you know | A memorized secret | Password, PIN, passphrase | Can be guessed, leaked, or tricked out of you | | Something you have | An object in your possession | Phone, FIDO2 key, card | Can be stolen or cloned (depending on the type) | | Something you are | A biometric characteristic | Fingerprint, face, iris | Cannot be "changed" if compromised |

Understanding this distinction is key: a strong password protects authentication, but without well-designed authorization, a compromised account could access far more than necessary. That is why the principle of least privilege, which we will see at the end of the course, complements authentication. Identity management, in turn, is what usually fails silently: the account of the employee who resigned six months ago and is still active is an open door nobody is watching — a classic finding in audits of companies of any size.

What Makes a Password Strong

For years, rigid rules —uppercase, numbers, symbols— were promoted that in practice produced passwords hard for humans to remember but easy for a machine to guess. The result was predictable: people typed Name2024! and believed they were safe. Modern research, reflected in guidelines such as those from NIST, prioritizes length over artificial complexity. A long passphrase like correct-horse-battery-staple resists an attack better than P@ssw0rd!.

The math behind this is simple: each additional character multiplies the number of possible combinations, so resistance grows exponentially with length, while adding a symbol to a short password barely moves it. An 8-character password, however complex, can fall to modern hardware in hours or days; a 20-character passphrase is out of brute force's practical reach. And it has an extra advantage: coffee-rain-guitar-thursday is easy to remember and to type; X#k9!q2$ is neither.

Attackers do not guess passwords one by one: they use dictionary attacks that try common words and their predictable variations (name123, Name2024!), brute force that runs through combinations, and above all credential stuffing, which reuses passwords leaked in other breaches. This last one deserves attention because it explains the real danger of reuse: when some random forum you registered on years ago suffers a breach, attackers automatically try that same email and password against banks, email providers, and social networks. If you reused the password, the breach of an irrelevant site becomes the breach of your entire digital life.

Current recommendations are clear:

  • Length first: passphrases of four or more words, or passwords of 16 characters or more.
  • Unique per service: the most important rule of all; no password is ever repeated.
  • No predictable personal data: names, birth dates, license plates, football teams — all of that is in attackers' dictionaries.
  • No forced periodic changes: rotating on a calendar without cause worsens choices (Pass01, Pass02...); you change a password when compromise is suspected.
  • Check for breaches: services like Have I Been Pwned let you check whether your email appeared in known breaches, so you can react in time.

A Simple Method for Creating Passphrases

For the few passwords you do need to memorize (your manager's, your computer login), a proven method is random words:

  1. Pick four or five words with no relation to each other. The more random the selection, the better; some people use dice and word lists to guarantee it (the method known as diceware).
  2. Join them with a separator: thermos-window-cactus-lantern-cloud.
  3. Check that they do not form a famous phrase or personal data: the lyrics of a well-known song or your street address will not do.
  4. Practice typing it a few times: within two days you will write it without thinking.

The result is long (more than 25 characters), easy to remember, and very expensive to brute-force. What you must never do is the cheap knockoff of this method: taking a single word and decorating it (Cactus2024!), because that is already in every attack dictionary.

A note for those who build systems: passwords are never stored in plain text; they are stored as hashes computed with algorithms designed to be slow (bcrypt, Argon2). As a user you do not control that, but it explains why some breaches are catastrophic (plain-text passwords) while others leave room to react (strong hashes).

Multi-Factor Authentication (MFA)

Multi-factor authentication (MFA) requires two or more independent factors, so stealing the password is not enough to gain access. It is, by far, one of the most effective and cost-efficient measures in all of cybersecurity: it blocks the vast majority of automated attacks against accounts.

The logic is that of a double lock: even if the attacker obtains your password through phishing or a breach —things that, as we saw, happen all the time— they still need your phone or your physical key to complete the login. And that second obstacle cannot be solved remotely or at scale, which is precisely what breaks the automated attacker's business model.

Not all second factors are equal. SMS codes are better than nothing, but vulnerable to SIM swapping: the attacker convinces the carrier (or a complicit employee) to transfer your number to their own SIM, and from then on receives your codes. Authenticator apps that generate time-based codes (TOTP), such as those based on the Google Authenticator standard or Authy, are more secure because the secret lives on your device. At the top are physical keys based on FIDO2/WebAuthn (for example YubiKey), resistant even to phishing because they cryptographically verify the website: even if you enter your details on a pixel-perfect fake page, the key refuses to authenticate because the domain does not match.

| Method | Security | Convenience | Vulnerable to | |---|---|---|---| | Password only | Low | High | Everything we saw: phishing, breaches, stuffing | | SMS | Medium | High | SIM swapping, interception | | TOTP app (time-based codes) | High | Medium | Real-time phishing (the user types the code into a fake site) | | Push notification | High | High | MFA fatigue (approving out of exhaustion after repeated prompts) | | FIDO2 physical key | Very high | Medium | Practically only physical theft of the key |

Two habits complete the picture: save the recovery codes the service gives you when enabling MFA (in your password manager or printed somewhere safe, because they are the emergency exit if you lose your phone), and never approve a login notification you did not initiate — that is the signal that someone already has your password.

Enabling MFA on email, banking, and critical service accounts should be an absolute priority. Email, in particular, is often the master key: if an attacker controls it, they can reset the passwords of almost everything else through the classic "forgot my password" flow.

Password Managers

It is humanly impossible to remember dozens of long, unique passwords. The solution is not to reuse them, but to use a password manager: an application that generates, stores, and fills in strong passwords, all protected by a single master password and, ideally, by MFA.

Tools like Bitwarden, 1Password, or KeePass encrypt your credential vault with strong algorithms, so that only you can decrypt it: not even the service provider can read its contents (a "zero-knowledge" architecture). Beyond convenience, they add security: each service gets a different, random password, and many managers alert you if one of your credentials appeared in a breach.

| Manager | Model | Cost | Best for | |---|---|---|---| | Bitwarden | Cloud, open source | Free with optional paid plan | Those seeking a balance of price, transparency, and convenience | | 1Password | Cloud, commercial | Subscription | Families and companies that value polish and support | | KeePass | Local file, open source | Free | Those who prefer full control without depending on the cloud |

Any of the three options is enormously better than using none: choose the one you will actually use every day.

There is a less obvious benefit worth knowing: the manager's autofill is itself a defense against phishing. The manager ties each credential to the exact domain where you saved it; if an email takes you to secure-bank-verification.com instead of your real bank, the manager will offer to fill in nothing. That silent "failure" is an alarm: if the manager does not recognize the site, stop and check the address.

Compared to the password notebook or the Excel file —common solutions in offices everywhere—, the difference is substantial: the unencrypted file can be read by any malware or curious coworker, does not generate random passwords, and does not warn about breaches. The notebook, at least, cannot be hacked remotely, but it does not scale and does not travel with your phone.

The only critical point is the master password, which must be long, unique, and memorable —a passphrase is ideal— and never shared or reused on any other service. Combined with MFA on the manager itself, this architecture offers an excellent balance between security and usability. For business use, managers with team plans add extra advantages: shared folders per department instead of the "passwords spreadsheet" circulating by email, and centralized revocation when someone leaves the company.

The Future: Passkeys and Passwordless Authentication

The industry is moving toward a passwordless world. Passkeys, based on the FIDO2/WebAuthn standard, replace the password with a pair of cryptographic keys: a private one that never leaves your device and a public one held by the server. When signing in, your device proves it possesses the private key without transmitting any reusable secret.

In practice, the experience is simple: the site asks you to confirm with your fingerprint, your face, or your device PIN — the same thing you use to unlock your phone. There is nothing to memorize and nothing to type. Google, Apple, Microsoft, and a growing number of banks and services already support them, and operating systems sync them across your devices.

This approach eliminates credential phishing and password breaches at the root, because there is no password to steal: the fake site cannot ask you for a secret that does not exist, and a server breach only exposes public keys, which are useless for authenticating. Although the transition will take time and passwords will remain with us for several more years, understanding these mechanisms prepares you for the authentication model that is becoming the standard. In the meantime, the practical recommendation is simple: enable passkeys wherever they are already available, and keep the rest of your accounts on unique passwords plus MFA.

Frequently Asked Questions

Is it safe to keep all my passwords in one place? Isn't that "putting all the eggs in one basket"? The basket matters less than its armor. An encrypted vault, protected by a strong master passphrase and MFA, is incomparably safer than the real-world alternative: weak, repeated passwords scattered across dozens of sites. Concentrated, well-protected risk beats dispersed, unprotected risk.

Can I write passwords down on paper? For a home user, a piece of paper safely kept at home protects against every remote attack — the online thief cannot read your drawer. It is a bad idea in offices (too many people around) and it does not scale, but as a backup for your master passphrase, stored with your important documents, it is perfectly reasonable.

Does biometrics replace the password? On your phone, your fingerprint or face normally unlocks a credential stored on the device; they are convenience more than replacement. With passkeys, that architecture becomes the main mechanism. The important nuance: biometrics cannot be changed if compromised, which is why they work better as a local device factor than as a secret sent to servers.

How often should I change my passwords? Only when there is a reason: it appeared in a breach, you shared it, you suspect a strange login, or you used it on someone else's machine. Mandatory calendar-based rotation is a practice in retreat, even in official guidelines.

What do I do first if a password of mine was stolen? Change it immediately on the affected service and anywhere else you reused it, sign out of active sessions from the account settings, and enable MFA if you did not have it. If your email was the compromised account, prioritize it: everything else gets reset from there.

Common Mistakes

  • Reusing passwords "only on unimportant accounts": credential stuffing turns the breach of a minor site into the key to your important accounts.
  • Meeting requirements with minimal effort: Name2024! satisfies every classic rule and is among the first things a dictionary attack tries.
  • Sharing work credentials: the shared "admin user" account makes it impossible to know who did what and multiplies the leak points.
  • Always answering security questions truthfully: your mother's maiden name and your first pet can be found on social media; if the service requires them, answer with invented data stored in your manager.
  • Not saving MFA recovery codes: losing your phone without them can mean losing the account.
  • Approving push notifications you did not initiate: that confirms to the attacker that the stolen password works — and opens the door for them.

Exercise: Audit Your Digital Identity

Before moving on to the next lesson, spend half an hour on this inventory:

  1. List your critical accounts: main email, banking, digital wallets, social media, work.
  2. Mark the repeated passwords: every repetition is a potential contagion; those go first on the change list.
  3. Check your email addresses on a breach-alert service and note which accounts appear compromised.
  4. Enable MFA on your email today, even if it is the only part of the exercise you complete: it is the account that opens all the others.
  5. Install a password manager and migrate at least your five most important accounts, generating new, unique passwords in the process.
  6. Save the recovery codes for each MFA you enable, in the manager's vault or printed and stored somewhere safe.

You do not need to finish everything in one day: the goal is to have the critical accounts covered this week and let the rest migrate as you use them.

Key Takeaways: an Identity Mini-Checklist

  • Authentication is proving who you are; authorization is what you are allowed to do. Do not confuse them.
  • Length beats artificial complexity: passphrases of four or more words, unique per service.
  • Install a password manager and migrate your accounts gradually, starting with the critical ones.
  • Enable MFA on email first (it is the master key to everything), then banking and main services; prefer TOTP apps or physical keys over SMS.
  • Store your recovery codes somewhere safe.
  • Check your email addresses on a breach-alert service and change any compromised password.
  • Adopt passkeys on the services that already offer them.

In the next lesson we will look at the cryptography that makes all this protection possible.