You can take actions today to strengthen your account security.
Most people lock their homes, secure their vehicles, and protect valuable possessions from theft. Yet when it comes to online accounts, many individuals continue to rely on a single password as their primary defense against cybercriminals.
Unfortunately, that approach is becoming increasingly risky.
Every year, billions of usernames and passwords are exposed through data breaches affecting retailers, social media platforms, financial institutions, health care providers, and countless other organizations. Once stolen, these credentials are often shared or sold online, where cybercriminals can use automated tools to attempt access to accounts across multiple services.
For students, faculty, and staff, compromised credentials can expose not only personal information but also university resources, research data, financial records, health care information, and academic work.
Fortunately, there are effective ways to significantly reduce these risks. Understanding how passwords, multifactor authentication (MFA), and newer technologies such as passkeys work together can help everyone better protect their digital lives.
The Problem with Passwords
Passwords have been used to secure computer systems for decades, but they have several inherent weaknesses.
First, people naturally choose passwords that are easy to remember. This often leads to predictable passwords, simple patterns, or passwords based on personal information such as names, birthdays, pets, sports teams, or favorite hobbies.
Second, many individuals reuse the same password across multiple accounts.
Imagine using the same key for your house, office, vehicle, and storage unit. If someone obtains that key, they gain access to everything protected by it. The same principle applies online.
When a website experiences a data breach and passwords are exposed, attackers often try those credentials on other services. This practice, known as credential stuffing, remains one of the most common ways attackers compromise accounts.
Even individuals who create strong passwords can be affected if they reuse them across multiple systems.
The challenge is not necessarily creating a strong password. The challenge is creating a unique password for every account and remembering all of them.
Why Strong Passwords Still Matter
Although passwords alone are no longer sufficient, they remain an important layer of protection.
A strong password should be:
- Long and unique
- Difficult to guess
- Used for only one account
- Not based on personal information
Security experts increasingly recommend using passphrases instead of traditional complex passwords.
For example:
BlueRiverCoffeeSunriseTrain
is often easier to remember and significantly harder to crack than:
P@55w0rd123
Length is often more important than complexity.
Longer passwords require substantially more effort for attackers to guess using automated tools.
Most importantly, every account should have a different password.
If one account is compromised, the exposure is limited rather than allowing attackers access to multiple services.
Enter Multifactor Authentication
Because passwords can be stolen, guessed, or reused, security professionals recommend adding an additional layer of protection known as Multifactor Authentication, commonly called MFA.
MFA requires users to provide a second form of verification beyond their password.
Common examples include:
- An authentication app approval
- A temporary code sent to a mobile device
- A security key
- Biometric verification such as a fingerprint or facial recognition
This approach dramatically improves security because attackers must obtain more than just a password.
Think of MFA as adding a second lock to your front door.
Even if someone acquires your password, they are significantly less likely to gain access without the additional verification factor.
Today, MFA has become one of the most effective defenses against account compromise.
Beware of MFA Fatigue
While MFA provides strong protection, cybercriminals continue to adapt their tactics.
One increasingly common attack is known as MFA fatigue.
In this attack, a criminal attempts to log in repeatedly using stolen credentials. The victim receives numerous authentication prompts on their device.
The attacker's goal is simple: overwhelm the user until they eventually approve one of the requests out of frustration, confusion, or curiosity.
To protect yourself:
- Never approve an unexpected MFA request.
- Only approve notifications that you personally initiated.
- Report suspicious authentication prompts promptly.
- Treat unexpected MFA requests as potential warning signs that someone may already have your password.
If you receive an authentication request when you are not actively logging into an account, deny the request and consider changing your password immediately.
Password Managers: An Overlooked Security Tool
Many people struggle to remember unique passwords for dozens or even hundreds of online accounts.
As a result, they often take shortcuts by reusing passwords or choosing simple combinations.
Password managers help solve this problem.
A password manager securely stores your credentials and can generate unique, complex passwords for every account.
Benefits include:
- Stronger passwords
- Reduced password reuse
- Easier account management
- Faster logins
- Improved overall security
Instead of remembering dozens of passwords, users only need to remember one strong master password.
For students juggling coursework, social media, banking, and personal accounts, or employees managing numerous work-related systems, password managers can simplify security while strengthening protection.
The Future: Understanding Passkeys
A growing number of technology companies are introducing a new authentication method known as passkeys.
Passkeys are designed to eliminate many of the risks associated with traditional passwords.
Without getting overly technical, a passkey allows users to authenticate using a trusted device such as a smartphone, laptop, or security key rather than typing a password.
Benefits of passkeys include:
- No password to remember
- Reduced risk of phishing
- Strong protection against credential theft
- Simplified sign-in experiences
Because passkeys are tied to trusted devices and cryptographic methods, attackers cannot easily steal and reuse them the way they can with passwords.
Although passwords are not disappearing overnight, passkeys are expected to become increasingly common across consumer and enterprise services in the coming years.
Cybersecurity Starts with Personal Responsibility
Technology alone cannot protect accounts.
Effective cybersecurity requires informed decisions by every member of the University community.
Students, faculty, and staff all have access to information that may be valuable to cybercriminals. Whether it is coursework, research data, payroll information, health care records, intellectual property, or personal information, every account represents a potential target.
Fortunately, protecting yourself does not require advanced technical skills.
Simple actions such as enabling MFA, using unique passwords, and staying alert for suspicious activity can dramatically reduce risk.
Small changes in security habits often have the greatest impact.
Five Actions You Can Take Today
Take a few minutes this week to strengthen your account security:
- Enable multifactor authentication wherever available.
- Use a unique password for every account.
- Consider using a password manager.
- Never approve unexpected MFA requests.
- Explore passkey options when supported by your devices and applications.
Bottom Line
Cybercriminals have become increasingly sophisticated, but they continue to rely on one simple fact: Many people still use passwords as their only line of defense.
Protecting your accounts today means thinking beyond passwords alone.
By combining strong passwords with multifactor authentication, leveraging password managers, and adopting newer technologies such as passkeys, you can significantly reduce the likelihood of becoming a victim of account compromise.
The strongest account is not the one with the most complicated password. It is the one protected by multiple layers of security.
A password may open the door, but multifactor authentication helps ensure you are the only person who can walk through it.