One Weird Trick to Beat Online Password Thieves: Stop Worrying So Much

If you still needed convincing that passwords are utterly broken as a system of online security, reports of the largest password theft in history ought to settle the matter. According to the New York Times, a Russian crime ring has obtained 1.2 billion username and password combinations and more than 500 million email addresses. (The Verge is skeptical.)

The news will trigger panic among some, but plenty of head-shaking resignation among others: after all, no amount of caution on the part of individual users—dreaming up really c0m¶L1c8te∂ passwords, changing them regularly, guarding against phishing—will make much difference if criminals can just grab the information from the companies it’s stored with. 

This is, as technology journalists like to point out, a huge problem—for the technologists charged with keeping the current system halfway functional, and inventing a replacement for it. For the rest of us, what’s most striking about the disastrous state of passwords is how few of the cautionary measures are actually worth taking. Once you’ve done those things, by far the biggest cost of thefts like that by the Russian gang, for most web users, is the pointless worry. 

Here is what you can do: use a password manager like Lastpass, Keepass, 1Password or Dashlane. The biggest stolen-password headaches happen when you’ve been using the same password for multiple websites; password managers take care of that by generating a different one for each site you use, then logging you in automatically. A different kind of risk arises when your password’s so short it can be easily cracked by brute force: at 1,000 guesses per second, a five-character password might take a few hours to crack; a 20-character code turns that into trillions of centuries. Password managers take care of that, too. 

These applications store all your data behind another password, so it’s reasonable to ask whether they’re secure themselves. The answer (explained in some detail at Lifehacker) is yes. Not perfectly secure, because nothing is, but almost certainly more secure than anything else you’ll want to do, in reality, as an alternative.

If you truly don’t want to use a password manager, consider devising a different password for each site and writing them down on a piece of paper. No, really: that way, they’re vulnerable only to people who get hold of the paper. If you follow the received wisdom of never writing down passwords, you’re much more likely to choose memorable and thus more easily crackable ones. 

Then turn on two-factor authentication where it’s available, even though it’s often incredibly annoying (and not necessarily all that secure).

Now comes the equally important final step: chill out.

No discussion of the crisis in passwords has stuck with me like this episode of WNYC’s media podcast TLDR, released in April. It features an interview by presenter Alex Goldman with a man named Y Woodman Brown. Notoriously, Brown posted a list of his passwords in a comment on the Washington Post’s website in response to a story about the Heartbleed bug. Unsurprisingly, his social media accounts were taken over, and he was widely derided as an idiot. But I think he might secretly be a spiritual master; his attitude to web security made me feel like an idiot for caring so much. 

Brown’s point (which he illustrated with reference to a scene from Good Morning Vietnam) wasn’t that he didn’t think he’d get hacked. It was that he’d chosen not to define getting hacked as a problem:

In the olden days, nobody even locked their front doors, not in the neighborhood I grew up in. And the choice is either live behind the locked door or don’t. And for me freedom is choosing not to live behind the locked door.

There’s a strikingly deep point here, I think, about the psychology of security. It isn’t that you should post your passwords where everyone can see them. (Or leave your front door unlocked.) It’s that you do get to choose, within certain limits, which things you’re going to get stressed out about trying to protect. Since perfect security is unattainable, trying ever harder to feel perfectly secure will just make you feel more vulnerable. As Alan Watts put it, it’s the constant effort to attain total security that makes us feel so insecure in the first place.

Once you’ve taken the obvious steps to protect the handful of online accounts that really matter, you have one remaining choice. On the one hand, you can live in an inherently insecure world and worry constantly about it. Or you can live in an inherently insecure world and not worry about it. The latter choice is easier said than done—but then again, probably also easier than remembering scores of different 20-character passwords.