Why this matters
Stolen or weak passwords are behind many break ins, and Ghana's SIM swap and WhatsApp takeover scams are attacks on identity. Security adverts list identity management, access controls and multi factor authentication. Getting access right is one of the most useful things an organisation can do.
Two words to keep separate
- Authentication answers "are you really who you say you are?" A password, a code or a fingerprint.
- Authorisation answers "what are you allowed to do?" A cashier can view accounts; only a manager can approve large reversals.
Passwords that hold up
Long beats clever. A passphrase of several random words, such as yam-river-lantern-kola (an example, never use it), is easier to remember and harder to guess than P@ssw0rd1. Every important account needs its own password, because criminals try leaked passwords on many sites. A password manager stores them safely so you only remember one strong master passphrase. Have I Been Pwned lets you check whether your email address appeared in known data leaks.