Securing your accounts: passwords, 2FA, and SIM swaps

Your exchange account, and the email behind it, are protected by a login. Most account thefts come from reused passwords, weak two-factor methods and hijacked phone numbers. This lesson closes those gaps.

Passwords

One password per account. When any website is breached, attackers try the leaked passwords everywhere else. A reused password is only as safe as the weakest site you used it on.

Use a password manager. It creates long random passwords and remembers them. You remember one strong master password. ethereum.org's security guide says: "We strongly recommend using one."

Make the master password long. Several random words are harder to crack than a short, complicated password.

One exception, from Lesson 30: your seed phrase does not go in a password manager.

Two-factor authentication

Two-factor authentication, or 2FA, asks for something you have as well as your password. The methods are not equal. The US cybersecurity agency CISA ranks them:

A security key checks the website's real address before it responds, so it will not log you in to a fake site. That is why CISA calls this type the "gold standard".

Use the strongest method each service offers. Any 2FA is better than none.

SIM swaps

In a SIM swap, a criminal convinces your mobile provider to move your number to their SIM card. They may impersonate you, bribe an employee or trick staff. Your phone loses signal, and they receive your calls and texts.

They then ask your email or exchange to reset the password, and the code arrives on their phone.

The FBI received 1,611 SIM-swap complaints in 2021, with losses of more than $68 million.

Defences

• Do not use text messages for 2FA on accounts that matter.
• Remove your phone number as a recovery option where the service allows it.
• Ask your mobile provider for a port-out lock or account PIN.
• If your phone loses service for no reason, contact your provider at once from another line.

Your email is the master key

Whoever controls your email can reset almost everything else. Give it your best protection: a unique password, a security key or authenticator app, and no text-message fallback.

The rest of the checklist

• Save backup codes. Print the recovery codes each service gives you and keep them offline.
• Turn on withdrawal allowlists. See Lesson 35.
• Keep devices updated. Install system and browser updates promptly.
• Stay quiet. The FBI and the SEC both advise against telling people what crypto you hold. Publicity makes you a target.
• Never share a code. No real employee will ask for your password or 2FA code.