Accounts & Authentication
Secure your digital identity with Managers, MFA, and Passkeys.
If you only do one thing today
- • Turn on the password manager you already have, then upgrade to Bitwarden or Proton Pass when ready.
- • Enable MFA on email, bank, Instagram/TikTok/Discord (an authenticator app beats SMS), and set a Two-Step Verification password on Telegram.
- • Download and store backup codes offline (print or password manager secure note).
Why use a Password Manager?
Humans are bad at creating random passwords. Computers are great at it. A password manager generates and stores unique, complex passwords for every account.
Bitwarden
Best default for most users: open-source clients, strong free tier, and broad device support.
Get Bitwarden →Google Password Manager
Good first rung on Android/Chrome. Using the built-in manager is far better than password reuse.
Apple Passwords
Built into iPhone, iPad, and Mac — a good first rung if you're all-Apple. Works on Windows via the iCloud Passwords extension.
How to Setup Bitwarden
Desktop (Windows / Mac)
- 1. Go to bitwarden.com and create a free account.
- 2. Install the Bitwarden browser extension for Chrome, Edge, or Firefox.
- 3. Log in to the extension.
- 4. After Bitwarden is working, turn off duplicate browser password prompts to avoid confusion.
Mobile (iOS / Android)
- 1. Download the Bitwarden app from the App Store or Play Store.
- 2. Log in with your account.
- 3. CRITICAL: Turn on AutoFill. iPhone: Settings -> General -> AutoFill & Passwords -> Bitwarden. Android: Settings -> search "Autofill service" -> Bitwarden.
- 4. Now Bitwarden can automatically type passwords into your apps.
Recovery & backup codes
- Download and store MFA backup codes offline (print or password manager secure note).
- Keep a second authenticator app/device enrolled when possible.
- Set a unique recovery email that also has MFA.
Lose the backup codes? You may need to contact support with identity verification—some services won't let you disable MFA without codes. This is why storing them safely matters.
Stop Using These Passwords
If you use any of these, change them immediately:
What "good" looks like
Long, unique, and generated by your manager. If you must memorize one, use at least 5 random words.
Data breaches: when a site leaks your password
Breaches happen to sites, not to you — even a perfect password can leak from a hacked service. What matters is how fast you respond.
- Check your email at haveibeenpwned.com — it lists known breaches that included your accounts.
- If the breached site’s password was reused anywhere else, change it everywhere. This is why unique passwords matter.
- Turn on 2FA for the breached account — a leaked password alone then isn’t enough.
- Expect follow-up phishing: scammers use breach data to write convincing “reset your password” emails.
Password managers and browsers do this automatically: Bitwarden’s reports, Chrome’s password checkup, and Apple’s Passwords app all flag leaked passwords.
A breach is the service’s failure, not yours. Don’t feel bad — just rotate the password and move on.
Multi-Factor Authentication (MFA)
MFA adds a second lock to your account. A stolen password is much less useful when the attacker also needs your phone, app, or security key.
Authentication factors visualization. Review the labels and use the controls, when present, to step through the diagram.
One lock: just a password
A password is something you know — and anything you know can be stolen, guessed, or leaked.
Most account takeovers start with a stolen password. MFA is one of the highest-impact switches you can flip. Strongest to weakest: passkey or security key, then an authenticator app, then SMS.
Authenticator Apps
Good default. Scan a QR code, get a new 6-digit code every 30 seconds, and keep access even when offline. A code can still be phished if you type it into a fake site, which is why passkeys are better.
Hardware Keys (YubiKey)
Strongest option. A physical USB/NFC key you plug in or tap. Phishing-resistant; entry models are about $29+, and advanced models cost more. Register at least 2 keys as backup.
Biometrics
Fingerprint or FaceID. Convenient, often used as a second factor on mobile devices.
SMS (Text Messages)
AVOID IF POSSIBLE. Vulnerable to SIM swapping attacks where hackers steal your phone number. Still much better than no 2FA at all.
2FAS
2FAS is free, open-source, works on iOS and Android. No account needed. Syncs between devices via iCloud/Google backup. Simple, no bloat.
Advanced Bitwarden Features
- Bitwarden Premium can generate MFA codes (TOTP). This is convenient but creates a single point of failure—if your vault is compromised, attackers get both your password and MFA. For highest security, use a separate authenticator app.
- Bitwarden can now store Passkeys, allowing you to sync them across all your devices, not just Apple or Google ones.
Gmail MFA Setup
- Go to 'Manage your Google Account' -> 'Security'.
- Click '2-Step Verification' -> 'Get Started'.
- Choose 'Authenticator App' (Recommended). Avoid SMS.
- Scan the QR code with 2FAS or another trusted authenticator app.
- Enter the 6-digit code to verify.
- CRITICAL: Download Backup Codes and store them offline.
Proton Mail MFA Setup
- Go to Settings -> 'Account and password'.
- Click 'Enable two-factor authentication'.
- Scan QR code with your authenticator app.
- Enter the 6-digit code.
- SAVE the recovery codes shown. This is mandatory.
Also protect the accounts people actually lose
Instagram / TikTok
Open Settings -> Account/Security -> Two-factor authentication. Use an authenticator app and save recovery codes.
Discord / gaming
Protect Discord, Steam, Roblox, Epic, and game stores. Recovery often depends on email access, so secure email first.
Telegram
Use Settings -> Privacy and Security -> Two-Step Verification. This adds a cloud password on top of SMS login.
Banking apps
For Privat24, monobank, and other banks, set a strong app PIN, device lock, and alerts. Never give codes to callers.
Email resets everything else. Treat Gmail, iCloud, Outlook, or Proton as your master account.
Parent/backup contact
For teens, decide who can help recover accounts before something happens.
Fast wins
- • Email, bank, and cloud storage should always have MFA. Use the strongest option each one offers: a passkey, hardware key, authenticator app, or your bank’s own app confirmation.
- • Avoid SMS unless no other option. If forced to use SMS, set a PIN with your carrier to reduce SIM-swap risk.
- • Store backup codes offline and label them by service.
Passkeys: The Future
Passkeys replace passwords with cryptographic keys stored on your device. You sign in with biometrics or your device PIN, and the key is tied to the real website so fake login pages cannot easily reuse it.
To setup on Google: Go to g.co/passkeys and click 'Use passkeys'.
- Passkeys work best when you’re signed into the same account on phone + laptop (Apple ID, Google, or Microsoft).
- On a shared computer, don’t save a passkey. Sign in with the passkey on your phone instead: pick the phone / QR code option and scan the code.
- Passkey portability is improving but not universal. Some platforms now support export (e.g., to Bitwarden), but check before relying on it.
MFA & passwords quiz
Question 1 / 4
What’s the biggest risk of using SMS for MFA?
Complete the Quiz
Pass the quiz above (70%+) to unlock topic completion.