privacyguides/privacyguides.org
1
1
Fork 0
mirror of https://github.com/privacyguides/privacyguides.org.git synced 2026-07-29 03:31:02 +00:00
Code Issues Activity

refactor: Follow Hugo leaf vs branch conventions

Browse Source
This commit is contained in:
jonah
2026-05-13 01:20:29 -05:00
parent 757a274ac3
commit 88f1894219
99 changed files with 552 additions and 552 deletions
Download Patch File Download Diff File Expand all files Collapse all files
content/wiki/basics/passwords-overview/_index.md → content/wiki/basics/passwords-overview/index.md
+6 -6
View File
@@ -18,19 +18,19 @@ This is called [credential stuffing](https://en.wikipedia.org/wiki/Credential_st
<mark>You should **never** rely on yourself to come up with a good password.</mark> We recommend using [randomly generated passwords](#passwords) or [diceware passphrases](#diceware-passphrases) with sufficient entropy to protect your accounts and devices.
All of our [recommended password managers](../../../tools/software/passwords/_index.md) include a built-in password generator that you can use.
All of our [recommended password managers](../../../tools/software/passwords/index.md) include a built-in password generator that you can use.
### Rotating Passwords
You should avoid changing passwords that you have to remember (such as your password manager's master password) too often unless you have reason to believe it has been compromised, as changing it too often exposes you to the risk of forgetting it.
When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](../threat-modeling/_index.md) calls for it, we recommend going through important accounts (especially accounts that don't use multifactor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage.
When it comes to passwords that you don't have to remember (such as passwords stored inside your password manager), if your [threat model](../threat-modeling/index.md) calls for it, we recommend going through important accounts (especially accounts that don't use multifactor authentication) and changing their password every couple of months, in case they have been compromised in a data breach that hasn't become public yet. Most password managers allow you to set an expiry date for your password to make this easier to manage.
<!-- TODO: Admonition -->
<div class="admonition tip" markdown>
<p class="admonition-title">Checking for data breaches</p>
If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../../../tools/software/news-aggregators/_index.md).
If your password manager lets you check for compromised passwords, make sure to do so and promptly change any password that may have been exposed in a data breach. Alternatively, you could follow [Have I Been Pwned's Latest Breaches feed](https://feeds.feedburner.com/HaveIBeenPwnedLatestBreaches) with the help of a [news aggregator](../../../tools/software/news-aggregators/index.md).
</div>
@@ -158,13 +158,13 @@ The best way to store your passwords is by using a password manager. They allow
There are many good options to choose from, both cloud-based and local. Choose one of our recommended password managers and use it to establish strong passwords across all of your accounts. We recommend securing your password manager with a [diceware passphrase](#diceware-passphrases) comprised of at least seven words.
[List of recommended password managers](../../../tools/software/passwords/_index.md){ .md-button }
[List of recommended password managers](../../../tools/software/passwords/index.md){ .md-button }
<!-- TODO: Admonition -->
<div class="admonition warning" markdown>
<p class="admonition-title">Don't place your passwords and TOTP tokens inside the same password manager</p>
When using [TOTP codes as multifactor authentication](../multi-factor-authentication/_index.md#time-based-one-time-password-totp), the best security practice is to keep your TOTP codes in a [separate app](../../../tools/software/multi-factor-authentication/_index.md).
When using [TOTP codes as multifactor authentication](../multi-factor-authentication/index.md#time-based-one-time-password-totp), the best security practice is to keep your TOTP codes in a [separate app](../../../tools/software/multi-factor-authentication/index.md).
Storing your TOTP tokens in the same place as your passwords, while convenient, reduces the accounts to a single factor in the event that an adversary gains access to your password manager.
@@ -174,4 +174,4 @@ Furthermore, we do not recommend storing single-use recovery codes in your passw
### Backups
You should store an [encrypted](../../../tools/software/encryption/_index.md) backup of your passwords on multiple storage devices or a cloud storage provider. This can help you access your passwords if something happens to your primary device or the service you are using.
You should store an [encrypted](../../../tools/software/encryption/index.md) backup of your passwords on multiple storage devices or a cloud storage provider. This can help you access your passwords if something happens to your primary device or the service you are using.