Well, 2016 is nearly upon us and what better time to consider some password related resolutions!

Change your damn passwords

Have you been logging into online banking with the same “really good” password for the past seven years?  You’re so proficient at typing it that it has become second nature, the keystrokes effortlessly flowing from your fingertips?  It’s time to change that bad boy.  Especially because it was such a profound work of the authenticatory arts that you used it for all of your other most important online endeavors – your 401(k)s, your credit cards, your medical provider portals, and your mortgage.

Diversify your damn passwords

It’s long been tossed around – is it better to have 50 completely different soft passwords, or one prodigious whopper of a password that couldn’t be cracked in a billion years, re-used ad nauseam.

There’s no right answer, except to say the right answer is neither of those answers.  There are only absolute truths:  easy passwords are easy to break, and using the same password everywhere only multiplies the exposure of a compromised password.  Strive for a reasonable compromise.  Everyone’s reasonable is different.

Password managers are controversial.  Do your homework before committing to one.  Do not let convenience outweigh security.  Maybe you leave a few, exceedingly important eggs out of that basket…just in case.

Two-factor your damn life

Many applications offer a two-factor authentication scheme; explore them and implement them.  I am particularly interested to see the progression of the token space in 2016, particularly the Bluetooth U2F token, which holds tremendous promise.  Until that matures, I encourage you to get your hands on a FIDO U2F key and see where it takes you.