Strategies for Remembering Login Credentials
You know that big red "EASY" button that Staples uses for their advertising? I've finally decided that the checkbox for "remember me" should really be labeled with a big red "FORGET" button. That may sound harsh, but as a person who frequently has to remind others of their usernames and passwords...or reset passwords...I highly recommend that you never click "remember me" or "remember this password" in your browser.
Back when we wrote this, our advice was to reuse a few memorable passwords. We don't say that anymore. If one site gets breached, a reused password opens every other account that shares it. Today the better answer is a password manager: a secure app that remembers a different strong password for every site, so you only have to remember one.
That "remember me" function is executed by placing a file (cookie) on your desktop. That means that if you are not at your desktop, you can't be remembered, or if your hard drive crashes, the cookie has likely disappeared. For most people, once that cookie is gone, they have no clue how to log onto the site or tool.
To really make life easier for yourself, try to stick with a few rules of thumb for creating new accounts (or updating existing ones):
- Use your primary email address as a username if possible, and stick with as few email accounts as possible. If in doubt, create a Google Mail account for yourself and use it for "all things loginable".
- If you can't use your email address, create an ultra unique variation of your name. When I can't use my email address, I use the first four letters of my first name, a dash, and the first four letters of my last name. Unless you are "John Smith", this approach will get you there most of the time.
- For passwords, length beats cleverness. Federal password guidance from NIST favors longer passwords (at least 15 characters when a password is the only thing protecting an account) and says sites should let you use password managers. A few random words strung together works well.
- Use a different password for every important account, and let a reputable password manager keep track of them. Skip the sticky note on your monitor.
- Turn on two-step verification (a code or prompt on your phone) wherever it's offered, especially for email and banking.
Most of all, think twice before clicking that "remember me" box on a shared or public computer. Let a password manager do the remembering instead.