All In One Womens Association logo: together women canDigital security follow-up
Week 2: Accounts

Lock the front door: protect your accounts

Your email and WhatsApp are the keys to everything else: your contacts, your sources, your other accounts. If someone takes them, they can reset the rest. This takes about 20 minutes in total.

1. Passwords: long beats clever

Attackers use programs that try millions of guesses a second. They try names, birth years and the usual tricks first.

Amina1990A name and a year. Among the first things tried.
Weak
P@ssw0rdSwapping letters for symbols is a well-known trick, and it is on every list.
Weak
qwerty123456A keyboard pattern. Common and quickly guessed.
Weak
blue-mango-drum-lantern-sevenFour or more unrelated words. Hard to guess, easy to remember.
Strong

The rules: make a passphrase of four or more random, unrelated words (16 or more characters). Use a different one for every important account, starting with your email. Never reuse a password between accounts, and do not copy the example passphrases from this page or from the training. Everyone has seen them.

2. Let a password manager remember

You cannot remember dozens of long, different passphrases, and you should not write them in your phone notes or WhatsApp chats. A password manager keeps them in one locked vault and creates strong ones for you.

Good free options

Bitwarden or KeePassXC. 1Password is paid. You only need to remember one strong master passphrase, so make that one a long phrase you will not forget.

Do not lose the master passphrase

Write it on paper and keep it somewhere safe at home, not in the same bag as your phone.

3. Add a second step (2FA)

A password alone can be leaked, guessed or tricked out of you. A second step means a thief with your password still cannot get in.

Best for most people

Authenticator app

Aegis, Google Authenticator or Microsoft Authenticator. A new code appears every 30 seconds.

Better than nothing

SMS code

Works on any phone, but texts can be intercepted, and a stolen or swapped SIM receives them.

Risky

No second step

One leaked password is enough to lose the account.

When you set up 2FA, the service gives you backup codes. Save them in your password manager or on paper, or you could be locked out of your own account if you lose your phone.

Never share a code. This includes the 6-digit code WhatsApp sends you, even with a friend, a "colleague" or someone claiming to be from WhatsApp or your bank. That code is how accounts get taken over. See how a takeover works.

Turn on WhatsApp two-step verification

  1. Open WhatsApp and go to Settings, then Account, then Two-step verification.
  2. Tap Turn on (or Enable) and choose a 6-digit PIN.
  3. Add an email address you can access, so you can reset the PIN if you forget it.
  4. Use a PIN different from your phone lock and your Mobile Money PIN.

WhatsApp will ask for the PIN from time to time. That is normal. If you get an email you did not ask for about changing your PIN, do not tap any link in it. Open WhatsApp directly instead.

Turn on 2-Step Verification for your Google account

Your Google account is the account behind Gmail, Drive, YouTube and your Android phone. Protect it once and you protect all of those.

  1. Go to your Google account and open Security.
  2. Under "How you sign in to Google", choose 2-Step Verification and follow the steps.
  3. Pick an authenticator app if you can. Save the backup codes.

Your three jobs this week

Tick them off as you go. Ticks stay on your device only.

Stuck on a step? Vote "I need help" in the Sunday action poll in the group, and a trainer will contact you privately.