Passwords: Increasing Organizational Security
A Note on Language
In this toolkit, we will sometimes use the word woman/women and feminine pronouns for simplicity and to recognize the significant impact technology-facilitated violence has on women and girls. We recognize that TFGBV also impacts trans, non-binary, and Two-Spirit people. We hope that all people impacted by TFGBV will find these documents useful.
Passwords are an important part of security at work, for the survivors we support, and in our personal lives by protecting our sensitive data and information. Most hacking incidents and data breaches are due to weak or stolen passwords. Below, we’ve listed some key tips for increasing password security within your organization.
Supporting Survivors: Prioritizing Safety
It is important to acknowledge that for many survivors, using strong passwords isn’t enough, and updating passwords can even be dangerous. If an abusive person regularly monitors devices and accounts, they may know that a password has been changed and may even be able to change the password themselves. Abusive people ca alson coerce or force survivors to share their passwords. They might even become more abusive. In some situations, making changes could also erase evidence.
There isn’t one “right” way to respond to an incident, only ways that do or don’t fit the survivor’s situation. What works for someone else may not work or be safe for a particular survivor you’re supporting. Always prioritize safety and trust your – and their – instincts. In addition to the rest of the tips in this document, these safety steps may be useful:
- Use a safer device. If a survivor thinks that someone could be monitoring their phone or accounts, suggest that they use a different device (such as a library computer or a friend’s phone) and an account that the abuser cannot access (and that they have not had access to in the past).
- For survivor-specific password tips, see Passwords: Simple Ways to Increase Your Security.
Password Tips for Organizational Security
The following tips are for organizations to be better informed when making decisions about employee password policies and practices. This could pertain to employee email or smartphone and database passwords as examples.
What Makes a Strong Password?
Focus on length. The best passwords are at least 12-15 characters long, containing letters, numbers, and symbols. Lowercase letters on their own are just as fine as mixing it up with numbers and symbols, as long as the password is long enough.
Keep it simple by creating a short sentence that’s easy to remember, like SummerIsMyFavouriteSeason. Be sure not to use any sentences that others are likely to guess or predict. For added strength, or if a website requires it, you can add numbers and symbols to the mix: SummerI$MyF@v0uriteS3ason.
Change it up. Use different passwords for accounts that contain sensitive or personally identifying information. If someone uses the same password across most accounts, once it’s been cracked for one account, all accounts become vulnerable. If your account hasn’t been compromised and you have created a strong password using the guidelines above, it’s not necessary to change your password often.
Different Ways Passwords Can Be Stored
Password Managers
Password managers securely remember passwords so you don’t have to! Most people avoid using different passwords for different accounts because it’s just too hard to remember them all, and writing them down isn’t safe. Luckily, password managers – tools that store and protect passwords – can help. These tools can also create passwords that are incredibly hard to crack. All passwords are kept within an encrypted vault, which can only be opened with a primary password. The primary password should be the longest, most unique password your employee has ever created, and it should not be stored by the password manager.
There are two important things to consider before choosing a password manager. They are:
- Does the company have the ability to see your stored passwords?
- Does the company see or store your master password?
The most secure options will be those that answer no to both of these questions.
Keys vs. Passwords
Instead of, or in addition to, a primary password, some password managers – and some websites – provide the option to use a passwordless authentication key, often called (depending on the company) a Passkey or Secret Key. A key is a piece of information stored in the device itself that tells a website or app that this device is allowed to access protected information. It is not uploaded to the Internet, so if the password manager company’s data is stolen, or someone obtains your password by some other means, the thief still won’t be able to read your information. This can make a passwordless key a useful option for people who control their own devices. Passkeys, which are a specific type of passwordless key that meets certain standards, are discussed more in the Multi-Factor Authentication section of this resource.
Other-Use-Account Password Managers
Some browsers (such as Firefox) and accounts that are used for other purposes (such as Google) have the option to use built-in password managers. While these can be convenient, they also carry the risk that someone who is able to get into your account will be able to steal your passwords because the security of the passwords is only as good as the security of your Google account, Microsoft account, Firefox account, or whatever other built-in option you use. For this reason, it is usually more secure to use a separate password manager that is only a password manager, such as 1Password or LastPass.
Password Safety Options
Two-Factor or Multi-Factor Authentication
Using two-factor or multi-factor authentication means that instead of just entering a password to log in to an account, the person will also need to enter a second piece of information. This option can be found in the account settings or security settings of the online service.
There are two distinct categories of multi-factor/two-factor authentication: “something I have” or “something I am.”
Currently, most services use the “something I have” version. Here’s how it works: after entering your password, the company will immediately send a short code to something you have: an email account, a text message or voice call to your phone, or an app you have installed on your device. You then enter that code on the website and, voila! – you are able to access your account. It confirms you are who you say you are because you verified you have the email account, cell phone, etc. that you previously connected to that account.
Hardware Authentication
If there is a concern about devices being monitored or compromised, or even having codes sent to staff’s personal devices, another option is to use a hardware authenticator, such as a YubiKey – a small object that can connect to a device as proof that you are who you claim to be. You can take a quiz to determine which type would work best for you.
This can be an excellent method of securing accounts and devices that doesn’t require using information already on your devices. However, you may be concerned about the loss of the device if it is shared by multiple staff members.
Biometric Authentication
More and more platforms have the option to use the “something I am” form of authentication – a fingerprint or your face, for example. Traditionally, these methods of authentication have been considered “more secure” than “something I have” methods. From an organizational perspective, if policy allows staff to use this method on organization-owned devices, a plan for when a staff member leaves is needed.
Passkeys
A passkey is a type of passwordless authentication key, briefly discussed in the password managers section above. Passkeys are a joint project of Google, Apple, and Microsoft to reduce the need for passwords, and they meet certain design standards. Passkeys are stored on devices – you never have to remember them and website or app operators never see them. Passkeys are used in combination with the device’s security method (e.g. biometrics like FaceID or TouchID, a password, a PIN) to log on to apps, websites, and other services that support them.
Passkeys can be a great option to increase privacy and security for many people, including many survivors. However, if an abusive person has physical access to one of your devices and has the ability to log on to that device – for instance, because they know your laptop login password or might coerce or force you to open the device with your thumbprint or face – this may not be the right option for you, as it could lead to the abusive person accessing not only that device but other devices you own from the same company (e.g. other Apple devices). This could also be complicated within an organization on agency-owned devices and staff needing to be on-site to access files.
Single Sign-On
Many websites offer the ability to use social media or email account credentials to sign in to their website or create an account (such as using your Facebook or Google account to create an account on or log in to LinkedIn, TikTok, a shopping site, etc). This is called single sign-on, and there are risks to using it.
While this can be helpful because it means one less account to remember a username and password for, there are several possible risks involved with using it. When you choose to do this, you are likely giving Facebook, Google, etc. permission to access more information about you than you already have. You’re also sharing information from your social media account with the new site or service.
A final risk to consider is that if someone’s social media or email account gets compromised, whether by a hacker or an abusive person, it means the other accounts they’ve used those login credentials for are also compromised.
How Someone Might Discover Your Organization’s Passwords and When to Change Them
There are a few different ways your organization’s passwords could be breached:
- They might appear in data breaches, where someone copies or steals information, such as a website’s database of usernames and passwords. Staff can check what breaches a given email address or phone number has appeared in at HaveIBeenPwned, which can help you figure out which passwords need to be changed.
- A family member might know them, either through consensual sharing, non-consensual monitoring, or guessing (if an easy password). Staff could also be tricked into giving a hacker one or more of their passwords. One common way they do this is by calling and pretending to be a representative from somewhere your organization is a customer and convincing them to give them private information. Another way is by sending an email pretending to be from a website, service, friend, or colleague, and giving them a website link to follow (i.e. phising). When you click on that link, you’re either directed to a fake website that asks for your private information, or the link launches malware on your computer. Ransomware attacks are becoming more frequent where a hacker refuses to give back an organization's files unless money is paid.
To support your development of safe tech use policies, WSC has developed a Use of Technology Policy Template Guide for Women’s Shelters and Transition Houses (PDF, in English only).
Technology-Facilitated Gender-Based Violence (TFGBV) is part of a continuum of violence that can be both online and in-person. If you or someone you know is experiencing TFGBV, you are not alone. You can use sheltersafe.ca to find a shelter/transition house near you to discuss options and create a safety plan. You don’t need to stay in a shelter to access free, confidential services and support.
Adapted for Canada with permission from NNEDV’s Safety Net Project, based on their resource Passwords: Increasing Your Security