Authentication vs. Authorization One-factor, “something you know” Cleartext, hashes, salts Entropy, complexity https://xkcd.com/936/ Two-factor, “something you have, something you know” Tokens, sms, totp Back them up! Authy will do this for you. Good/bad practices Don’t use things that can be gained by social engineering Your dogs name Mother’s maiden name Keys close together on the keyboard are bad (sequences like 12345, qwerty, etc) Don’t use dictionary words Don’t replace letters with numbers (4 for A, 3 for E, etc) Don’t reuse passwords on multiple sites Password Managers https://lastpass.com/f?38035982  Dead Man’s Switch Password expiry Letter/number substitution Writing the password down??