account protection in practice: from strong passwords to recovery

The foundation and first line of defence of our online security is using proper passwords; without them even the most modern systems remain vulnerable. In this article we therefore focus on exactly this topic, password security: we present the most important basic principles, how password managers work, and the practical steps with which you can immediately strengthen your protection.

In addition, we do not hold back the most difficult scenario either: we also go through what you can do if the trouble has already happened and your account has fallen into the wrong hands.

According to cybersecurity experts^{Source 1}, your password should be at least 16 characters long. Length significantly increases the time it takes attackers to crack your password with automated tools. Short passwords (even if they look complicated) can be cracked quickly if they are shorter than 16 characters. The difference is drastic: what takes hours or days for a short password can mean millions of years for a 16-character one. Longer passwords slow attackers down so much that most of them give up and move on…

Moreover, the official authentication guidelines^{Source 2} also confirm that the length of a password is far more important than mixing complex characters (lowercase letters, uppercase letters, the @ sign or numbers). 

Don’t blame yourself if you have used the same code in several places so far – you are not alone.

According to Bitwarden’s global survey^{Source 3}, 84% of people still reuse their passwords across different sites today.

But unfortunately, if your password leaks from a single site, attackers’ software tries it on all your other accounts within moments. This way, one small mistake can put several of your accounts, or even your personal and banking data, at risk…

But how can anyone be expected to remember such long passwords, and a different one for every account? This is where password managers^{Source 4} come in.

You can download password managers as an app on your phone, or add them with one click as an extension to your computer’s browser. You only need to remember a single master password (or use your fingerprint), and when you register somewhere, the program generates a strong password, saves it, and next time automatically fills it in for you.

Here are a few reliable and completely free options you can download or turn on:

• NordPass: From the makers of NordVPN. A very clean, modern and easy-to-use interface, in whose free version you can also save an unlimited number of passwords.
• Bitwarden: One of the most competitive free options at the moment. You can store an unlimited number of passwords, and it syncs them across all your devices (mobile, PC).
• Built-in managers (Google/Apple): If you don’t want a separate app, Chrome’s or the iPhone’s own system can also generate strong passwords and store them securely.

You can protect your online accounts with more than just a password. Multi-factor authentication (MFA) adds an extra layer of security to your protection. It is a simple yet remarkably effective way to keep hackers out even if they have somehow managed to get hold of your password.

How does it work in practice? When you try to log in from a new device, the system asks for a second verification in addition to your password. So if someone gets hold of your password in a database leak, they cannot get into your account, because they do not have your physical device.

• Authenticator apps (recommended): The Google Authenticator or Microsoft Authenticator apps generate codes that change every 30 seconds. This is more secure than SMS, because it needs no cell signal, and it is much harder to intercept in any way…
• SMS code: Although experts say it is more vulnerable than authenticator apps, it is still miles more secure than using no second step at all. If a site offers only this, definitely use it!

If you notice that you have been locked out of your account, strange posts appear in your name, or you receive login notifications you did not initiate, then the faster you act, the greater the chance of getting your account back.

• 1. Try to log in and change your password!
• If you still have access, quickly change your password to a new one (one you have never used before), and choose the “log out of all other devices” option.
• 2. Use the official recovery routes!
• Every major platform (Facebook, Google, Instagram) has a dedicated page for reporting hacked accounts (e.g. facebook.com/hacked). There you can verify your identity with your previous passwords, identifiers or the face recognition feature.
• 3. Warn your acquaintances!
• As we showed in our previous article, attackers often try to deceive others in your name. Publish a post on another platform, or ask a friend to let people know that your account has fallen into the wrong hands and that nobody should click on links coming from you.
• 4. Check your connected apps!
• See which other sites you have logged in to with this account (e.g. “Sign in with Google”), and if necessary, cut the connection there too or change the password.
• 5. Review your bank transactions!
• If a bank card was linked to the hacked account (e.g. an ad manager or a web shop), contact your bank immediately and, if necessary, block the card.

If you have also encountered similar scam attempts, write to us about your story at the email address innolink.srl@gmail.com, as you may be able to help others avoid such an unpleasant experience.

And if you need help, don’t hesitate to get in touch with us! We are very happy to help you keep your accounts safe (or with any other topic as well).