Your Passwords Are Already For Sale

The simple fix I alluded to in the last chapter has to do with passwords.

I told you it was simple. It is. And I need to show you why it matters before you dismiss it as something you already know about.

Go to haveibeenpwned.com. It’s a free service run by a security researcher named Troy Hunt — it aggregates publicly known data breaches and lets you check whether your email address appears in any of them. Type in your primary email. The one you use for everything.

I’ll wait.

If you’re like most people, you just found out that your email address has been exposed in multiple breaches. The site currently indexes over fifteen billion compromised accounts across more than nine hundred breached websites. Yours are in there. Not because you did anything wrong — because the services you trusted with your data got hacked, and the data ended up in databases that anyone can search.

Now here’s the part that turns this from an abstract privacy problem into a concrete security emergency: if you reused the same password across multiple sites — and most people do — then every breach that exposed that password gave an attacker the key to every other account that uses it. This isn’t theoretical. It’s the single most common way accounts get compromised. An attacker doesn’t hack your email — they find the password you used on a shopping site that got breached in 2019, try it on your email, and it works. It has a name: credential stuffing. It’s automated, it runs at scale, and it works because human beings are predictable about passwords.

Your email account is the skeleton key to everything else in your digital life. Think about it. When you forget a password to any other service, where does the reset link go? Your email. If someone controls your email, they can reset the password on your bank, your social media, your health portal, your cloud storage — anything tied to that address. Securing your email is not the most interesting security topic. It’s the highest-impact single action most people can take.

Two things to do. Both tonight.

First: install a password manager.

I recommend Bitwarden. It’s free. It’s open-source, which means its code is publicly available and independently audited — you don’t have to trust the company’s promises about security because anyone can inspect the system. It generates long, random, unique passwords for every account and stores them encrypted. You remember one password — your master password — and Bitwarden handles the rest. 1Password is not open-source but is an excellent alternative and works the same way.

Your master password should be long. Not complex — long. “correct horse battery staple” is stronger than “P@$$w0rd!” and infinitely easier to remember. A passphrase of four or five random common words, maybe with a number thrown in, gives you something that’s both memorable and effectively unguessable through brute force. Write it down on paper and keep it somewhere physically secure until you’ve memorized it. Not in a file on your computer. Paper.

Install Bitwarden or 1Password on your phone and your primary web browser. Perform a password reset for your primary email account — let Bitwarden create it, long and random. Log in with the new password. Save it in Bitwarden. That’s one account down.

You’re going to be doing this gradually for every account you currently have and every new account you create. Don’t try to do them all tonight — you’ll burn out and quit. Start with your email. Over the coming days and weeks, every time you log into a site, take thirty seconds to change the password to something Bitwarden generates. The slow migration works. The all-at-once approach doesn’t.

Second: turn on two-factor authentication for your email.

Two-factor authentication — 2FA — means that even if someone has your password, they still can’t get in without a second piece of proof. Your email provider almost certainly supports it.

Here’s the hierarchy, plainly:

SMS-based 2FA — a code texted to your phone — is better than nothing. But it can be defeated by SIM-swapping, where an attacker convinces your phone carrier to transfer your number to their device. This isn’t exotic — it happens regularly, and phone carriers have gotten only marginally better at preventing it.

An authenticator app is significantly stronger. Download one — Google Authenticator, Authy, or the one built into Bitwarden itself. It generates a code that changes every thirty seconds and exists only on your device. No phone number to steal, no text message to intercept.

A hardware security key — a physical USB device like a YubiKey — is the strongest option. It’s a small investment and it’s overkill for most people’s threat models right now. If you wrote “Tier 2” or “Tier 3” in your field journal this morning, look into it. Everyone else: the authenticator app is where you want to be.

Go to your email account’s security settings. Enable 2FA. Choose the authenticator app option if it’s available. Walk through the setup. It takes three minutes.

---

Record this in your field journal. Which breaches showed up on HaveIBeenPwned. Your primary email’s 2FA status — what method you chose. Which accounts still use reused passwords — you don’t need to fix them all now, but write the list. You’ll work through it.

Password reuse creates a single point of failure that collapses the boundaries between different parts of your life. Over a thousand people were identified after January 6 through a convergence of digital evidence. But compromised accounts and shared passwords contributed to identification chains most people wouldn’t expect. Private messages accessed through breached credentials. Accounts linked through reused passwords. The forensic process of unraveling someone’s digital identity is a lot easier when every door opens with the same key.

Whatever’s in your threat model — your employer, your ex, a data broker, law enforcement — reused passwords make you an easy target. Unique passwords make the pieces harder to connect.

Your email is now behind a unique password and a second factor. That’s the most important account in your digital life, and you just secured it.

But the messages inside that email — and every message you send through every app on your phone — are still readable by anyone who sits between you and the person you’re talking to. Your phone carrier. The app company. Anyone with access to the server. Tomorrow I’ll show you what “encrypted” actually means, why most of what you think is private isn’t, and what to do about it.

---