The 20-minute password reset weekend

If you do exactly one security project this year, make it this one. It takes about 20 minutes per family member, costs nothing, and removes the single largest source of account compromise.

Step 1 — Pick a password manager

Any reputable one will do. The MenHerr Family plan includes one; Bitwarden, 1Password and Apple's iCloud Keychain are all fine. The point is not which tool, the point is to have one.

Step 2 — Reset the five accounts that matter most

In this order: your primary email, your password manager, your bank, your phone carrier, your government / IRS account. These five, if compromised, give an attacker the keys to almost everything else.

Step 3 — Turn on two-factor authentication on those five accounts

Use an authenticator app rather than SMS where possible. Save the recovery codes inside your password manager.

Step 4 — Use a different password for every site, going forward

You do not need to reset all your other passwords today. Just commit to never re-using a password again. The next time a site says "incorrect password", reset it to a generated one and let the manager save it.

That is the whole project. Done well, it takes a Saturday morning and prevents the most common attack on the internet.

← Back to all articles