Securing your accounts without becoming an expert

Securing your accounts does not require you to become a cryptography expert. Above all, you need to prevent a single incident — a leak from a minor website, a lost phone or a fake form — from giving access to your entire digital life.

A good method rests on four elements: a different secret for each service, a strong second factor, up-to-date recovery options and the ability to spot an unusual login.

Your email is the master key

When an attacker takes control of an email address, they can request password resets for many other accounts. They read the confirmations, delete the alerts and learn which services you use.

So start with your main email account. It must have:

• a unique password;
• a second factor;
• an up-to-date recovery address and phone number;
• active sessions checked regularly;
• no forwarding rules you did not create yourself.

Then do the same for your password manager, bank accounts, important social networks and the administration of your website or business.

Why a complex password is not enough

Suppose you use a twenty-character password on ten services. One of those services is breached and stores passwords poorly. The stolen credentials are automatically tried on email providers, shops and social networks.

The attacker does not need to crack your password. They already know it.

This is "credential stuffing". It explains why uniqueness matters more than symbols tacked onto the end of a reused word.

Every account must have a different password. Since nobody can reasonably memorise a hundred of them, you need a password manager.

Choosing and using a password manager

A password manager generates long, random passwords, stores them encrypted and fills them in on the right website. You only memorise one master passphrase.

Check a few criteria:

• end-to-end encryption;
• a second factor or passkey to open the vault;
• the ability to export in a usable format;
• a documented security policy and known audits;
• support for the devices you use;
• a clear procedure if you lose a device.

The password manager built into your browser or operating system is already a major improvement over reusing passwords. The perfect tool you never use protects you less than a simple solution adopted every day.

When the manager flags a reused password, start with the most important accounts. There is no need to fix everything in one night.

Building a master passphrase

Choose several unrelated words, long enough to form a memorable phrase. Avoid well-known quotes, song lyrics, family dates and variations on `P@ssw0rd`.

This phrase should only be used for the password manager. Do not photograph it or email it. If you are worried about forgetting it, a paper copy kept in a suitable private place can be safer than an unprotected file.

The aim is not to create a secret that is impossible to type, but one that is long, unique and rarely exposed.

Second factor, passkey and physical key

A second factor adds proof that the password alone is not enough.

### SMS

SMS is better than no protection at all, but it depends on your phone number and can be targeted by SIM swapping. Use it when the service offers nothing else.

### Authenticator app

Time-based codes provide a good level of protection for most accounts. They can still, however, be entered on a fake page and passed on immediately to the real service.

### Push notification or mobile approval

It is convenient, but beware of approval fatigue. An attacker can send repeated requests until the user accepts one. Never approve a request you did not trigger yourself.

### Passkey or security key

These methods are tied to the website's domain. An imitation site should not be able to reuse them. They offer the best resistance to phishing for sensitive accounts.

Register at least one backup method. Protection that depends too heavily on a single device can lock you out of your own account.

Recovery options are often the back door

You can protect the main login perfectly and still leave an old recovery address accessible to someone else.

Once a year, check:

1. that the backup address still exists and is itself protected;
2. that the phone number is correct;
3. that recovery codes are stored offline;
4. that no unknown device is marked as trusted;
5. that no unnecessary third-party app has access to the account.

Old security questions should be treated like passwords. A true answer — town of birth, a pet's name — is often public. Store a random answer in your password manager.

What to do after a login alert

Do not click directly on the alert email. Open the app or website the way you usually do and check the login history.

If the access is unknown:

• change the password;
• revoke all sessions;
• check the factors and recovery options;
• review your email rules;
• look for changes made during the session;
• secure any accounts where the old password was reused.

For a work account, alert the support team or the person in charge. A compromised account may have sent messages to your contacts even if nothing seems to have changed.

Tidying up without spending the whole weekend on it

Unused accounts remain entry points. They sometimes contain an old address, documents or an authorisation to a service that is still active.

Twice a year, spend half an hour:

• deleting services you no longer need;
• revoking connected apps;
• checking sessions;
• fixing passwords flagged as compromised;
• updating recovery codes;
• confirming that your password manager's backups or exports are accessible.

A regular schedule is more effective than a big clean-up only after an incident.

For a family or a small team

Do not share a password by messaging app. Use the password manager's secure sharing feature. Each person keeps their own named account; the shared secret can be replaced without mixing identities.

Also document critical access. In an association, who can recover the domain, the bank, the email or the social media accounts if the person in charge is away? A sealed envelope, a shared digital vault or a procedure involving two people prevents a single departure from blocking the whole organisation.

Official resources

• Safeonweb — advice on staying safe online
• CCB — account compromises observed in Belgium (FR)