Why strong passwords still leave your accounts exposed

A strong password is only one layer

Most of us have seen our email or password show up on Have I Been Pwned at least once. With every service demanding an email or phone number, credential leaks are almost a given.

The piece argues that users lean too heavily on passwords. They’re only one-third of a solid security setup. To meaningfully reduce account risk, you need to harden three pillars together: email identity, passwords, and two-factor authentication (2FA).

Treat your primary email like a secret

Your main email address effectively functions as your digital identity card. Yet many people spray it across sign-up forms, newsletters, and random sites.

Recommended reading

Mira Murati’s lab unveils Inkling, a 975B open model

The article suggests treating that primary address as something close to a secret. The practical way to do that is to use email aliases:

• Aliases are randomized addresses that forward mail to your real inbox.
• You hand out aliases to services and people, while your primary address stays hidden.
• If a service is breached and an alias leaks, you can disable that alias and spin up a new one in a few clicks.

Because your primary email is tedious to replace across “every single account you’ve used it on,” it becomes a critical asset to protect. The article points to services like SimpleLogin and DuckDuckGo as options for generating and managing aliases so you can keep using services without exposing your core identity.

Passwords still matter — but uniqueness wins

If email is the lock, the article frames passwords as the key. Complexity requirements on modern sites have pushed us toward long strings of symbols and mixed case, but that alone isn’t enough if you reuse the same password or trivial variants everywhere.

The author strongly recommends password managers:

• You remember a single strong master password.
• The manager generates unique, high-entropy credentials for every service.
• A breach on one site doesn’t cascade into access on others.

Password managers also blunt phishing. A fake login page that only looks right to you may not match the exact domain the manager expects, so it won’t auto-fill. Some modern managers even bundle email alias features, letting you create both a new alias and a new password at sign-up.

For people daunted by “hundreds” of existing logins, the recommendation is incremental migration: update passwords as you log in over days or weeks rather than in one marathon.

2FA: the alarm system on top

Once email and passwords are in better shape, the final layer is two-factor authentication. The article likens 2FA to an alarm that goes off when someone picks the lock.

2FA adds a second proof—a one-time password, TOTP code, or physical security key—on top of your login. That second factor can block access even if both your email and password have leaked. It also tips you off when you receive unexpected OTP prompts, buying time to rotate credentials.

The article ranks options this way:

• Physical security keys like YubiKey are “among the safest” second factors.
• Authentication apps that generate time-based one-time passwords (TOTPs) are a widely available middle ground. The author cites Ente Auth as a personal pick, but notes you can use any app that fits your needs.
• Whatever you choose, lock the 2FA app behind a separate PIN distinct from your device PIN to reduce shoulder-surfing and theft risks.

SMS-based OTPs get criticism in security circles, but the article argues they are still better than having no 2FA at all. The key is to use some form of 2FA rather than none.

Three tools, one goal: stop account takeover

The article closes on the reminder that, as Dwight Schrute put it, “Identity theft is not a joke, Jim! Millions of families suffer every year.” Many people either know a victim or have been hit themselves.

The central argument: a three-tiered security system—protected primary email, unique passwords via a manager, and properly configured 2FA—makes it “nearly impossible” for most intruders to assemble enough pieces to compromise your accounts.

Relying on just one of these layers can create a false sense of security. When all three are in place and maintained, each becomes a fallback for the others, and your accounts become significantly harder to break into.