Passwords and Two-Factor Authentication

Your password is the front door key to your accounts. A strong password and two-factor authentication stop most account takeovers.

What Makes a Password Weak?

Attackers do not guess one password at a time by hand. They use programs that try millions of common passwords and patterns per second. These passwords are broken almost instantly:

• 123456, password, qwerty
• Your name or city: ali1998, karachi123
• Words with simple swaps: P@ssw0rd
• Any password that was already leaked in a data breach

What Makes a Password Strong?

A good method is a passphrase: four or more random words, such as chai-rickshaw-mango-cloud. It is long, easy to remember and hard to guess.

Measuring Password Length

This Python program shows how many guesses an attacker needs for different password types. It uses 95 printable keyboard characters:

charset = 95
for length in [8, 12, 16]:
    guesses = charset ** length
    print(f"{length} chars: about {guesses:.1e} guesses")

8 chars: about 6.6e+15 guesses
12 chars: about 5.4e+23 guesses
16 chars: about 4.4e+31 guesses

Going from 8 to 16 characters makes the password about 6.6 million billion times harder to guess.

Generating a Random Password

Python's secrets module is made for security. It creates random passwords safely:

import secrets
import string

alphabet = string.ascii_letters + string.digits + "!@#$%&*"
password = "".join(secrets.choice(alphabet) for _ in range(16))
print(password)

q7R!mZp2#Lx9Wd&K

You will get a different result every time you run it.

Password Managers

Nobody can remember 50 unique random passwords. A password manager remembers them for you:

• You remember one strong master password
• The manager creates and saves a unique password for every website
• It fills in passwords only on the real website, which also helps against phishing

Popular options include Bitwarden, 1Password and the managers built into Chrome, Edge, Firefox and Apple devices.

How Websites Store Passwords

A well-built website never stores your actual password. It stores a hash, a one-way scrambled version, with a random salt. Developers use special slow hashing functions such as bcrypt or Argon2:

import bcrypt

hashed = bcrypt.hashpw(b"chai-rickshaw-mango-cloud", bcrypt.gensalt())
print(bcrypt.checkpw(b"chai-rickshaw-mango-cloud", hashed))
print(bcrypt.checkpw(b"wrong-password", hashed))

True
False

If the database leaks, attackers get only hashes, which are very slow to crack when the passwords are long.

Two-Factor Authentication (2FA)

2FA asks for a second proof after your password. There are three kinds of factors:

1. Something you know: a password or PIN
2. Something you have: your phone, an authenticator app or a security key
3. Something you are: a fingerprint or face

Common 2FA methods, from weakest to strongest:

Turn on 2FA for email, WhatsApp (two-step verification PIN), Facebook, Instagram, banking and mobile wallet apps first.

Exercise