Heads up! To view this whole video, sign in with your Courses account or enroll in your free 7-day trial. Sign In Enroll
Preview
Start a free Courses trial
to watch this video
This video introduces tools and strategies to address some of the shortcomings of password-based logins.
New Terms:
- Password Fatigue -- A tiredness associated with the inconveniences of passwords in a daily routine. Can lead to poor security choices for relief.
- Credential Stuffing -- An automated attack attempting the login information from a leaked account with a different service in hopes that the targeted user reused the info.
- 2-Factor Authentication -- An additional layer of security requiring two forms of proof, like an ATM card and a PIN.
- Security Questions -- Asked by sites as a limited form of 2-factor auth to provide a level of “proof” of identity. Many of the answers to these questions are available through public record or provided by social media profiles.
Further Reading:
Password Managers:
Article: The Best Password Managers of 2024
People have strong feelings about their password managers. Choose one the best fit your needs.
Related Discussions
Have questions about this video? Start a discussion with the community and Treehouse staff.
Sign upRelated Discussions
Have questions about this video? Start a discussion with the community and Treehouse staff.
Sign up
In the last video, we explored
the importance of password strength.
0:00
They should be unique, sufficiently
complex, and the longer the better.
0:04
But doing this for every site and
service can lead to password fatigue.
0:08
Many people just don't think it's
worth the inconvenience of coming up
0:13
with long unique passwords for
everything they do.
0:16
And it inevitably leads to the breaches
we discussed in our very first video.
0:19
And one of the biggest risks you
can take is to reuse a password for
0:24
more than one site.
0:28
Imagine that you've created
a really strong password.
0:30
You think it's nearly unbreakable,
so you use it for social media, for
0:33
your email, and for your bank.
0:37
If, for example,
the social media account is breached,
0:39
that password is effectively
out in the open.
0:42
Many attackers can then try what's called
credential stuffing, using an automated
0:45
tool to attempt the username and password
breached from one site on another.
0:49
Now those attackers can
access your bank and email.
0:54
So password uniqueness is just as
important as password strength.
0:58
Password managers are great tools because
they address the convenience security
1:02
trade off directly.
1:06
They reduce the inconvenience and
frustration that can come from
1:08
password fatigue, and
they up your security in the process.
1:12
They're likely better at generating
strong passwords than any human would be.
1:16
Now, with a strong unique password for
each site,
1:21
we're safe from credential stuffing
attacks if a service ever has a breach.
1:24
But that doesn't help for
the hacked site itself.
1:28
Another type of tool exists to protect
your data even if your password
1:31
is out in the open is called
two factor authentication.
1:35
It's more of a feature that you can enable
for sites that support it than it is
1:39
a service you can purchase,
but it is highly recommended.
1:43
Two factor auth is an additional layer
of security on top of your passwords.
1:47
It is often a code that is sent
to you as a text message or
1:52
generated on a device you own,
like your smartphone.
1:55
In fact, you likely already use it
in your life without realizing it.
1:58
It's the reason you carry an ATM card and
use a pin.
2:02
This is how two factor auth often
is used for your online accounts.
2:06
You log into a site with your username and
password.
2:10
The site then prompts you
again to enter a code.
2:13
That code is either texted to you, or
better yet, you have set up a special app
2:17
on your phone that generates these
codes for you every 10 or so seconds.
2:22
You entered that code and
now you're logged in.
2:27
It's a little extra effort upfront.
2:30
But two factor authentication is an
incredibly effective security mechanism.
2:32
Your data is safe even if
your password was leaked or
2:36
even if you were tricked
by a phishing scam.
2:40
I'd like to offer a few additional notes
about password managers, email, and
2:43
security questions.
2:48
Password managers store your secrets,
which make them prime targets for hackers.
2:49
Make sure that you are comfortable with
that level of trust, and you still need to
2:55
be extra cautious with that final password
used to log into the password manager.
2:59
Another security concern to think about
is that your email is often used as your
3:04
personal identity.
3:09
If you lose access to your email or
it's compromised in some way,
3:11
many sites offer password recovery or
reset through your email.
3:15
Your email account would be an ideal
place to start enabling two factor
3:19
authentication for this exact reason.
3:23
As another mode of password reset and
recovery, and even sometimes as a limited
3:26
form of two factor authentication,
sites will ask you security questions.
3:31
They're meant to be questions
that only you would know and
3:36
would have the answers readily available,
but
3:39
would prevent strangers from
attempting to take over your account.
3:41
This may have been effective in the past,
but choosing the right questions and
3:45
answers can often be harder than
generating a strong password.
3:49
And with questions like what is the name
of the high school you went to?
3:52
The answers can often be easily found
on a person's social media profile,
3:56
so be mindful of these questions.
4:00
And when available, we should all be
moving to more secure two factor auth
4:02
options like the co-generating
apps on our smartphones.
4:06
You need to sign up for Treehouse in order to download course files.
Sign upYou need to sign up for Treehouse in order to set up Workspace
Sign up