Yahoo 1 billion accounts hacked: Don’t make these password mistakes

WHAT’S A GOOD PASSWORD?

The more complicated and lengthy a password is, the harder it will be for hackers to guess.

Don’t include your kids’ names, birthdays or references to any other personal details. Hackers routinely troll Facebook and Twitter for clues to passwords like these. Obvious and default passwords such as “Password123” are also bad, as are words commonly found in dictionaries, as these are used in programs hackers have to automate guesses.

Long and random combinations of letters, numbers and other characters work best.

Your password reset questions should be as unique as possible too, and don’t be tempted to recycle those either. This was some of the information stolen in the Yahoo hack. And with the help of social media, it’s not hard for hackers to find those little personal tidbits like what your mother’s maiden name is, or the name of your hometown.

IS IT OK TO REUSE PASSWORDS?

No. Avoid using the same password for multiple sites, so that a break of your school’s PTA site wouldn’t lead hackers to your online banking account.

You can make things easier on yourself by using a password-manager service such as LastPass or DashLane. They remember complex passwords for you — but you have to trust them. Last year, LastPass disclosed “suspicious activity” and told users to change their master passwords.

Some web browsers such as Apple’s Safari and Google’s Chrome also have built-in password managers. They work if you switch devices but not if you switch browsers.

SHOULD I CHANGE MY PASSWORD?

While some security experts argue that it’s more important to pick a complicated password than to change them frequently, if you haven’t changed your Yahoo password since 2013 do it now.

And even if you have changed your Yahoo password in the last three years, you might want to do it anyway. Breaches are often worse than they first appear. LinkedIn disclosed earlier this year that a 2012 breach affected 117 million accounts— not the 6.5 million previously thought.

Read: Yahoo under scrutiny after latest hack, Verizon seeks new deal terms

WHAT MORE CAN I DO?

Multi-factor identification — which asks users to enter a second form of identification, such as a code texted to their phone — will provide additional protections. It’s now commonplace for many email and social media accounts.

Even if hackers manage to get your password they still need your phone with the texted code.

SHOULD SOME ACCOUNTS BE TRASHED?

Delete or deactivate accounts you no longer use. Has your Yahoo email account been filled with spam since before the invention of smartphones? Maybe it’s time to say goodbye.

That goes for social media too, (remember Myspace?). This often can be done through your account settings — as long as you still have your password to sign in.

WHAT ABOUT SOCIAL MEDIA SECURITY?

And while we’re on the subject of social media, make sure you restrict posts to just your actual friends. You can adjust that in the settings.

Some companies try to help their users with this. Facebook, for example, occasionally prompts its users to review who can see their personal information and how strong their security settings are.

Nonetheless, assume that everyone everywhere can see what you’re posting. That’ll keep hackers from harvesting those juicy details they can use to crack into your accounts.