Account security: the six ways into an account

Account security rarely fails at the password. People protect the front door and lose the account through the side. A long password, changed regularly, guarded carefully, and then the account is taken through a recovery flow that never asked for the password at all.

That is the shape of most account loss. The password is one of six ways in, and it is neither the weakest nor the one that gets used most. Working on it exclusively feels like security and leaves the other five untouched.

What to take away

Where the account actually ends

The perimeter is wider than the login screen. There are six ways into an account, and only the first involves the password.

The password itself. Usually obtained from somewhere else, because passwords reused across services travel from one breach to the next. This is why a unique password per service matters far more than a complicated one.

The second factor. Some kinds can be handed over by the account holder without realizing it, and some can be redirected by someone else. The kind you choose changes how exposed you are.

The recovery route. The path designed for you when you have lost everything. It is the most powerful door in the building, because it is built to work without any of the others.

An existing session. A device already signed in does not need to authenticate again. Sessions persist for long periods and often survive a password change.

Connected access. Third-party apps, integrations, delegated users, and team members hold their own access that does not go through your login at all.

Support. A person at the provider can restore access to someone who has convinced them. This route exists for good reasons and it is not one you control.

Any honest security review walks all six. Most people walk the first and stop.

Email first, and differently

Almost every other account you have will send its reset link to your email. That makes the email account the master key, and it should be treated as a different class of thing from everything else.

That means a password used nowhere else, and the strongest second factor you can use rather than the most convenient. It means recovery options you control and keep current, plus a periodic look at the settings that quietly change what happens to your mail.

The settings worth checking, because they are altered early and noticed late: forwarding rules, filters that move or delete messages automatically, alternate addresses listed for recovery, delegated access, and connected applications. A rule that quietly forwards or deletes specific messages lets someone keep receiving your resets and notifications long after you have changed your password.

If you use a phone number or a secondary address for recovery on your email, those become part of the same perimeter. Anything that can restore your email can reach everything your email can reach.

Recovery is the weakest wall

Recovery flows have to work for people in genuine distress: no phone, no access, no records. That requirement makes them accommodating by design, and accommodating is exactly what an attacker needs.

What to do about it, on your important accounts:

Second factors are not equal

Any second factor is better than none. They differ in what they actually resist, and knowing the order lets you put the strong ones where they matter.

The important column is the second one. A code you can read and type is a code you can be persuaded to type somewhere else, whatever its source.

Keys and passkeys are the only common option that will not work on a site that is not the real one. That makes them worth the setup effort on your email, your primary accounts and anything holding money. The public case for turning on a second factor at all is CISA's guidance on multi-factor authentication.

By name: one-time codes delivered by text message or email are the weakest, and codes generated in an app such as Google Authenticator, Microsoft Authenticator or Authy are stronger but can still be read out to someone. Push approval on a phone adds a check, especially with number matching. Passkeys and hardware keys such as a YubiKey are the only common options that will not release anything to a page that is not the real one, and Google, Apple and Microsoft all support them, and all three show your active sessions and connected apps from a security page in the account settings.

One rule covers the rest: nobody legitimate ever needs a code that was sent to you. Not the provider, not a bank, not support, not a colleague. A code arriving that you did not trigger means someone is trying to sign in as you, and it is a signal to change your password rather than a message to answer.

Sessions and devices outlive passwords

Changing a password does not necessarily sign anyone out. On many services, existing sessions continue until they are ended explicitly.

So when you suspect anything, the sequence is: change the password, then sign out all other sessions, then review the device list. Doing the first without the second leaves whoever it is still inside, and they can simply set a new password of their own.

Review the active session and device list periodically on important accounts. Look for locations and devices you do not recognize, and for sessions much older than the devices you actually use. Remove anything you cannot account for, and accept that occasionally you will sign yourself out of something, which costs a minute.

Connected access is the part nobody audits

Each of these is a door that does not touch your password. Some of them survive changes you make to your own credentials. Some belong to companies that no longer exist, whose own security is now nobody's responsibility.

Go through the connected apps list on each significant account once or twice a year and remove everything you are not currently using. Removing something you still need costs you one reauthorization. Leaving something you stopped using costs you an open door you have forgotten about.

For shared and business accounts, the same applies to people. Access should be individual rather than a shared login, removed the day someone leaves rather than the next time anyone thinks about it, and reviewed on a schedule. A shared password known by five people is known by everyone those five have ever told.

The first hour when something is wrong

Order matters, because access can narrow at any moment.

Do not use links in any message about the incident to reach the provider. Go to the service the way you normally do. The provider-by-provider version of this sequence is set out in the FTC's guidance on recovering a hacked email or social media account.

The same sequence applies to a hijacked social media account, whether Instagram, Facebook, X or TikTok, where the first sign is usually a message to your contacts that appears to come from you. Treat that message as the signal to start at step one, not as something to reply to.

The maintenance pass

Twice a year, in under an hour, on the accounts that matter:

The information you make available publicly feeds directly into how convincing an attempt against you can be, which is the other half of this work: see privacy settings.

What to hold on to

Account security depends on its weakest entry point, and that is almost never the password. Harden your email account, know and close your recovery paths, and use a factor a fake page cannot reuse.

Clear out sessions and connected apps nobody has looked at in years.

Common questions

How often should I change my password?

Routine scheduled changes tend to produce weaker passwords, because people modify a pattern. Change immediately if a service reports a breach, if you have reused that password elsewhere, or if you suspect anything. Otherwise a strong unique password can stay.

Is a password manager safe?

For almost everyone it is a large net improvement, because the alternative in practice is reuse, and reuse is what actually loses accounts. Protect it with a strong unique passphrase and the strongest second factor available, and make sure you have a recovery plan for the manager itself.

Someone knows my password but I have a second factor. Am I fine?

No. Change it now. They may be waiting for a moment when you are likely to approve a prompt or hand over a code, and if that password is used anywhere else, those accounts are already exposed.

I keep getting sign-in prompts I did not trigger.

That means someone has your password and is trying. Do not approve any of them. Change the password from a device you trust, sign out other sessions, and move that account to a stronger second factor.

What if I lose access to my second factor?

That is what the backup codes are for, which is why printing them is worth doing before anything goes wrong. Failing that, you are in the recovery process, which is slow, sometimes unsuccessful, and much easier if you have kept evidence of ownership.