Use a separate password
Password reuse links the security of unrelated services. A breach on one website lets attackers test the same credentials elsewhere.
A long random password stored in a password manager is more practical than a short phrase with predictable substitutions.
A useful baseline
- one unique password for every service;
- a strong master password for the manager;
- never sharing passwords or verification codes.
Protect your device and email
Email is often used for recovery, so protect it with a second factor and keep recovery details current.
Install operating-system and browser updates. Avoid signing in on shared devices, and explicitly end the session if you must use one.
Regular checks
- review active sessions;
- remove unknown devices;
- check changes to contact details.
Prepare safe recovery
Store backup codes offline and away from the main password. Answers to recovery questions should not be obvious from social profiles.
If you suspect a takeover, secure the email account first, then change the account password and end all sessions.