Accounts: The Part That Actually Gets You

Start with the one that changed: current federal guidance, finalized in 2025, drops the rules everyone hates. No forced periodic changes. No mandatory mixture of capitals, digits and symbols. No password hints and no security questions.

What it keeps is what works: length over complexity, screening new passwords against lists of known-breached ones, and explicit support for password managers, including allowing paste.

So: a different password everywhere, kept in a manager, because reuse is what turns one company's breach into your problem at ten other companies.

Then the second factor, and the ladder matters. Text-message codes are the weakest — phishable, and they fall with your phone number, an attack that has produced tens of millions of dollars in reported losses in a single year. Codes from an authenticator app are better, though a live phishing page can still relay one.

A passkey or a hardware key is the top. The key checks the site's identity cryptographically, so a convincing fake gets nothing usable and the human never has to notice anything.

Now the part people skip. Recovery is a parallel route in, and it is where strong accounts are broken. A long unique password and an authenticator app are decoration if the recovery question asks for a school name that is on your public profile.

Remove the questions where you can, answer them with stored nonsense where you cannot, register a second key, and keep backup codes somewhere you could reach without your phone.

Protect your email and your phone account first and hardest, in that order. They are the recovery route for everything else, which makes them the master key whether or not you think of them that way.

After a breach notice, the priority is not the breached account. It is everywhere you reused that password.