A collage with an image of a person on TikTok

The Washington Post

0423-help-TIKTOKUSERS

0514-tf-HDGoogleSearch

A person using binoculars looking at search bars.

0215-helpdesk-searchnow

TF-GoogleFindMy

A collage with an iPhone in a monster truck.

0507-tf-iPad

A person listening to headphones, meditating and holding a camera.

0503-tf-FunTech

0501-help-MSFTPASSKEYS

Mario jumps out of a phone with a victory #1 foam finger.

0430-TF-AppleCracks

An image of a flapper showing off her hip flask during the Prohibition against alcohol in the 1920s, but the flask has been replaced with a TikTok app.

0426-TF-TikTokQuestions

A no smoking sign at the German airport

iStock

An abstract illustration of a phone with shortcuts.

0418-help-SHORTCUTS-final

For The Washington Post

Goth characters hide in app-shaped holes in a phone.

0416-tf-gothapps

An illustration of a cereal box with internet symbols.

4120-TF-InternetLabels

Kyiv,,Ukraine,-,August,25,,2023:,Engraved,Apple,On,Iphone

ILLUSTRATION

An illustration of the Earth orbiting YouTube

0409-TF-YOUTUBE

Graphics reporter

Shooting the eclipse with your phone

A yellow tote bag with dotted lines showing the contents: a power bar to charge a phone, a solar-powered charger, a compass, a waterproof phone case, a weather radio, and an N95 mask

0719-help-emergencykit

0405-TF-TechHype

Respond to prefers-color-scheme dark in app web views

Follow section front redirects in Spectrum

Enable NLP source in PCS for load testing

Switch off the News Alerts Survey Widget when we have enough responses

Poll to determine if new LUF updates are available

Allows the winning A/B test variant to be turned on without Spectrum deployment

Show infinite scrolling sections in Assembler MultiView

Show option for NLP article summaries in Action Bar

Show NLP summaries collection recirc on article pages

A general feature flag for Recipe Features that aren't yet released

Feature flag for media team features that aren't yet released

Use new Orca video player for preroll plugin in Spectrum

Show the snow tracker (instead of the heat tracker) on Spectrum

Look to the cloud to protect the life documents saved on your computer

Can you spot bad financial advice on TikTok? Take our quiz.

5 myths about Social Security as the program faces a funding crisis

The Post’s choices in Northern Virginia’s U.S. House primaries

States see legalized sports betting as a tax windfall — but at what cost?

Haiti’s plight is a case study in the ‘responsibility to protect’

Cruise settles with person dragged under one of its robotaxis

Google’s AI answers could come back to bite it

Senators studied AI for a year. Critics call the result ‘pathetic.’

Carolyn Hax: Fiancé plans to have a baby with someone else

Ask Sahaj: I live with my parents and generational trauma ‘runs the house’

Miss Manners: Co-worker lies to avoid doing her job

Elections 2024 live updates: Biden campaign accepts invite to a vice-presidential debate 

David Trone and the history of candidates lighting their money on fire

Trump allies call trial a ‘sham.’ Public opinion isn’t cooperating.

Best Places to Work in the Federal Government 2023

Suspect in Slovakian prime minister shooting arrested

Frankie the colored bull terrier wins terrier group

Riots are flaring on a French archipelago in the South Pacific. Here’s why. 

Shooting leaves Slovakia’s Fico in serious condition, country on edge 

Who is Robert Fico, Slovakia’s prime minister who was shot?

Netflix will air NFL’s Christmas games, a major step for streaming service

Sam Feist, longtime CNN executive, will become CEO of C-SPAN

Michael Cohen testimony ties Donald Trump to hush money payment

The 35 best things to do in D.C. this weekend and next week

Rating every game on the Commanders’ 2024 schedule

The 26 best new restaurants in the D.C. area

Flying budget airlines might not be as cheap as it seems

Some cruise prices are about to get a little more clear

Cruise ships to return to Baltimore two months after bridge collapse 

Puppy abandoned with heart-rending note is adopted, named Minerva

Man, 91, shocks tiny firehouse with $500K gift: ‘Nobody knew how much I’d saved’

Retired cop meets abandoned baby he helped 23 years ago: ‘What are the odds?’

President Joe Biden Joint Chiefs and Combatant Commanders 

Big Tech news and how to take control of your data and devices

See more coverage in your recommendations

Technology

Tips delivered to your inbox twice weekly

The Tech Friend newsletter

Business and Tech alerts

This article is a preview of The Tech Friend newsletter. <a href="https://www.washingtonpost.com/newsletters/the-tech-friend/?method=SURL&location=ART&itid=lk_inline_manual_1&itid=lk_inline_manual_1&itid=lk_inline_manual_1&itid=lk_inline_manual_1&itid=lk_inline_manual_1&itid=lk_inline_manual_1&itid=lk_inline_manual_2&itid=lk_inline_manual_2" target=_blank>Sign up here</a> to get it in your inbox every Tuesday and Friday.

The whole system of online passwords is dumb and unsafe.

Demanding that you create a unique,<a href="https://www.washingtonpost.com/news/the-switch/wp/2014/08/07/how-to-keep-track-of-your-passwords-without-going-insane/" target="_blank"> complicated password on hundreds of digital accounts</a> is error-prone and annoying. Most of the advice you hear about passwords — including from technology journalists like me — is unrealistic, scolding and sometimes outdated.

I have tips for upgrading your password practices, including if you’re dealing with a recent breach of a password vault called LastPass. I know that tending to your online security is a hassle. But if you make one small improvement, you can declare victory.

I also want you to have this long-term mission in mind: Passwords must die.

There is hope. Just in the past few months, more websites and apps have started to let you ditch your password entirely. Instead your phone, fingerprint or face are proof that you are you.

Technologists have been promising a password-less future for a long time. This won’t happen soon. But <a href="https://www.washingtonpost.com/technology/2018/07/12/your-password-has-likely-been-stolen-heres-what-do-about-it/" target=_blank>internet security is broken beyond repair</a>. We need to move past the password.

In the meantime, you are a security star if you take just one of these steps:

To create the best password, try to make it at least 16 characters. The more characters, the more time hackers need to guess your password. Don’t worry so much about having a bunch of symbols, capital letters and numbers.

Security experts recommend using memorable phrases as passwords, with a twist. If you like nursery rhymes, try the password, “L1ttleMi$sMuffetSatOnATuffet,” with a number and symbol replacing a couple of letters. Or mush together four words into nonsense like “TumblerElbowMerinoWoodpecker.”

Not every online account lets you set up passphrases like that, because of requirements derived from <a href="https://www.wsj.com/articles/the-man-who-wrote-those-password-rules-has-a-new-tip-n3v-r-m1-d-1502124118" target=_blank>obsolete government security guidelines</a>.

Again, there is too much individual responsibility and blame on you. <a href="https://www.washingtonpost.com/technology/2021/12/16/secure-password-guide/?itid=lk_inline_manual_9" target=_blank>You know</a> you’re not supposed to create easy-to-guess passwords like “RedSox04” or reuse your passwords on multiple sites. But no human can invent and remember hundreds of complex passwords.

Try to prioritize by creating strong passwords or passphrases for your most important accounts such as email, financial accounts and password managers. (More on them in a minute.)

Consider two-step authentication on your important accounts

Needing a password plus a second step to log into an account — such as a code that is texted to you — protects you much better than logging in with just a password.

If you can manage it, <a href="https://www.washingtonpost.com/technology/2022/04/27/two-factor-authentication-2fa-lost-phone-what-to-do/" target=_blank>add two-step authentication</a> to your essential accounts like email, social media and your bank accounts.

This is common online security advice that most people don't take. Don’t blame yourself. It takes work and not all online accounts let you use two-step authentication. (<a href="https://2fa.directory/us/" target=_blank>This website</a> lets you look up the options for websites and apps you use.)

Using a dedicated app for one-time codes like Authy, Microsoft Authenticator or Google Authenticator is more secure than receiving codes by text. But don’t get too hung up on those details.

The Online Security Reset Guide: Keeping you safe from scammers, hackers and digital threats

There’s a reason my colleagues have repeatedly recommended password managers. Services like 1Password and Dashlane generate strong passwords on each of your accounts, store them in a digital lock box and fill them in automatically when you’re on websites and apps.

You create a single password to your password vault, and these services save the rest.

Password managers aren’t foolproof. I’d also rather scrub my bathtub than set them up. But they are a smart investment in your online security.

I have used Dashlane for years, and while it’s not cheap — I pay about $65 a year — I find it easy to use and worth the peace of mind. It also delights me by typing in passwords and credit card numbers automatically.

As a backup to memorizing my Dashlane passphrase, I have it written down on two slips of paper, one that I keep in my desk drawer and another in my wallet.

If you’re thinking, what if a thief steals my wallet and has access to all my passwords? Is it safe to store all your passwords in one place? Nothing is zero risk. But anything you do with a password manager is probably a security upgrade. Please don't try to be perfect.

Read more <a href="https://www.washingtonpost.com/technology/2022/04/07/password-manager-setup/" target=_blank>advice on how to get started with a password manager</a> or alternatives like saving all your passwords in a notebook. That’s great, too! (Some of these tips are outdated, but the basics still stand.)

6 easy fixes to avoid tech headaches in 2023

LastPass, one of the better-known password management services, recently disclosed that hackers <a href="https://www.washingtonpost.com/news/the-switch/wp/2016/07/28/people-downloaded-this-tool-to-keep-their-passwords-safe-but-it-had-a-major-flaw/" target=_blank>stole copies of usernames and passwords</a>.

LastPass told customers that they’re probably safe because essential information including passwords was scrambled. That makes it harder for crooks to make sense of what they stole.

But Chester Wisniewski, an internet security researcher with the firm Sophos, told me that he's alarmed about years of red flags with LastPass. He recommended that users consider switching to an alternative.

Wisniewski said he feels confident in password managers 1Password, Bitwarden and Dashlane. (Here are instructions from <a href="https://support.1password.com/import-lastpass/" target=_blank>1Password</a>, <a href="https://bitwarden.com/help/import-from-lastpass/" target=_blank>Bitwarden</a> and <a href="https://support.dashlane.com/hc/en-us/articles/7865163497618-Move-your-data-from-LastPass" target=_blank>Dashlane</a> to switch over from LastPass.)

I asked LastPass representatives to respond to Wisniewski’s advice. They pointed me to the company’s recent <a href="https://blog.lastpass.com/2022/12/notice-of-recent-security-incident/" target=_blank>blog post</a>.

Wisniewski also said that LastPass might still be a good option for you. An alternative like using your child’s name as your password is far less secure.

Have I mentioned that the system of passwords is dumb and you can only do so much to protect yourself in this broken system? Yes?

Here's where things start to get promising.

Some companies, including Microsoft, Best Buy and <a href="https://newsroom.paypal-corp.com/2022-10-24-PayPal-Introduces-More-Secure-Payments-with-Passkeys" target=_blank>PayPal</a>, have started to give you the option of accessing your account with no password.

This isn’t totally novel. Some apps let you log in with just with your fingerprint or face scan — but it mostly works on your phone. You still have a password somewhere. Now imagine you use your phone or other device, finger or face scan as the sole way you log in everywhere.

Last week, I <a href="https://www.washingtonpost.com/technology/2021/09/15/microsoft-passwordless/" target=_blank>deleted the password from my Microsoft account</a> and asked to log in without a password. Now when I tap on Skype on my Android phone or use Outlook email on my computer, I am prompted to confirm a two-digit number I can see in the Microsoft Authenticator app on my phone. (I need to unlock the Authenticator app with my fingerprint.) That’s it.

Hacks and data breaches are all too common. Here’s what to do if you’re affected.

Microsoft told me that nearly half a million people have removed the password from their accounts and opted to log in without a password.

This password-less system, which the technology industry is calling “passkeys,” is now baked into Android phones, iPhones, personal computers and major web browsers.

For now, going without a password isn’t seamless. When I created a PayPal account in the iPhone app and confirmed I wanted to use <a href="https://www.washingtonpost.com/video/business/technology/upgrade-with-geoffrey-fowler/how-well-does-the-iphone-x-face-id-work-and-is-it-secure/2017/11/03/8fcf3772-c0bb-11e7-9294-705f80164f6e_video.html" target=_blank>iPhone’s FaceID</a> to log in, I still needed to create a password. Still, the technology is getting there.

It’s worth rooting for passkeys to kill the password system for good, although this will take many years.

Security experts told me that passkeys, which use proven cryptography practices, are more secure than the password systems in use today. Hackers also can’t steal passwords or trick you into giving them away if there are no passwords at all.

Even better, it’s simpler to access your accounts with just your device, finger or face. It’s not a problem if you lose your phone or computer. And logging in without a password will become easier over time.

If your accounts give you the option of the password-less log in called passkeys, definitely try it.

I usually roll my eyes when I hear that magical technology will fix a broken existing technology. In this case, yeah, passkeys might be the magic fix.

You can make yourself safer within the stupid password system we have today. But it’s even better to end the tyranny of passwords forever.

After speaking to online security experts for this piece, I realized that I could make a couple of changes to improve my password practices, too.

With the help of Dashlane, I made longer passwords to my Google account and my financial accounts. I also replaced the 10-character Dashlane password with a 20-character passphrase of four mushed-together words.

I have known for a long time that I needed to make a stronger Dashlane password. I just didn’t do it. Give yourself a break. Everyone can benefit from a small security improvement or two, and it’s never too late to start.

Brag about YOUR one tiny win! <a href="https://docs.google.com/forms/d/e/1FAIpQLSdPvgG8CZNsbX95t6QrBLbYK444i7MpFnQcK3Iy53Nl_I0SGg/viewform" target=_blank>Tell us about</a> an app, gadget or tech trick that made your day a little better. We might feature your advice in a future edition of The Tech Friend

Haverford College

Columbia Journalism School

Shira Ovide writes The Washington Post's The Tech Friend, a newsletter about making your technology into a force for good. She has been a technology journalist for more than a decade and wrote a tech newsletter at the New York Times. 

Shira Ovide

washpost

Four realistic steps to upgrade your online security

the-washington-post

Elena Lacey/The Washington Post; iStock

0110-techfriend-passwords

[Help Desk | Perspective] Everything you’ve been told about passwords is a lie