# The strong password, the breach, and the multi-factor save

- Link: https://www.agilicus.com/strong-password-breached-backstopped/
- Published: 2021-04-15T00:03:56+00:00
- Author: Don Bowman

I performed my period audit of my accounts. And, to my surprise, I found the password
for my rubygems was in the breach corpus. The 2nd-factor caught the save, but… the
password was generated via `pwgen 12` (so it looked like `aibeaNongoo0`). I think
you will agree that was not guessed somehow. So, on this topic, when was the last
time you opened chrome://settings/passwords/check?start=true and checked your accounts
for safety? Well, read the next couple of paragraphs and then go to it.

There’s a spectrum of password strength. One the one end, some people use something
guessable (a pet, a birthday), and, they re-use the password on many (all?) sites.

Next we have those who have a strong(ish) password, but reuse that across multiple
sites.

And then we have the strongest password approach: every site gets its own password,
and they are strongly generated. This necessitates a password manager (I use KDE
Wallet, which stores in my GPG keyring).

Layered on top of this is a multi-factor strategy. Interestingly, it dramatically
imrpoves all three strategies. The breach of the bad password does not have your
2nd-factor code generator in it. These end up being uncorrelated risks, and the 
combination is very strong.

However, this is becoming very tedious. Over the years one accumulates hundreds 
of online accounts. Some merchants force one to buy a single product. A few forums
here and there, suddenly you have two or three hundred accounts to audit. Changing
the password across them is no mean feat.

So what is the solution? My very strong password was breached on a single site, 
saved only by the 2nd factor. Well, in my opinion, the answer is to remove the password.
That’s right. Rather than make it 16 characters long, I want to go to 0. Use a single
common identity provider, via OpenID Connect. Secure that appropriately (strong 
password + 2nd-factor). And force each and every web site I use to accept it for
authentication (without sharing the password).

OK, gentle reader, now your homework. Open chrome://settings/passwords/check?start
=true. Check yourself out on [https://haveibeenpwned.com/](https://haveibeenpwned.com/).
In your browser, in the saved passwords, if it flags any, fix it. That means going
to the web site in question, and changing the password to a new single-use one, 
and enabling multi-factor authentication if available.