- So how do we do better with passwords?
We've used passwords for decades
in order to protect our accounts
and we can see that they are no longer sufficient.
So there are two angles we can look at this problem from.
One from the consumer side,
and one from the organizational side.
From the organizational side we need to do a better job
of securing and encrypting our passwords themselves.
So that means use hashing algorithms,
use salted hashes to actually increase
the difficulty for actually cracking the passwords,
and also from an organizational standpoint
we need to secure the password storage as well.
On top of that, from an organizational standpoint,
organizations should support longer passwords.
I know you'll probably look at some websites
where they'll say they only support passwords
up to eight characters.
And we can't do that
from an organizational standpoint anymore.
We really need to support longer and longer passwords
because longer passwords are much more secure
than smaller complex passwords.
From a consumer standpoint,
there isn't too much they can do
to manipulate how the passwords are stored,
so really consumers should look for
two-factor authentication,
they should definitely enable two-factor authentication
on all their accounts,
and even if a password gets compromised
if an individual has two-factor authentication
on their account the intruders can't get into their account
without having, let's say, their phone as well.
So there are many systems that do not support
two-factor authentication
so that's on the organizational side
to actually implement.
But from a consumer standpoint,
you know most of the popular applications
now support two-factor authentication
from all of your email clients
to all of your social media clients as well.
The onus is on the consumer side, though,
to go into your settings
and actually turn those features on.
Very highly recommended to implement
two-factor authentication.
And while that won't prevent any breaches,
it will prevent an intruder from actually
accessing your account once that information is breached.