14-002 · EVIDENCE C · SOURCE-SENSITIVE
Use a unique password solely for your email
邮箱密码单独一个，不和任何网站重复
No cost involved. Storing it in a password manager eliminates the need to memorize it. The real challenge lies in breaking the old habit of reusing one password across multiple sites.
If a password you use elsewhere gets stolen, attackers can use it to log straight into your email account. Once they gain access to your email, they can reset passwords for any other accounts linked to it. Therefore, your email password must be unique and never reused anywhere else.
C
Move “Use a unique password solely for your email” to Future Me's calendar
The excuse
I can spend longer deciding whether to start than the small action would take.
What feels good now
Today I keep a few minutes, a bit of persistence and avoid interrupting my default routine.
What the source says
The source summarizes the return this way: “If a password you use elsewhere gets stolen, attackers can use it to log straight into your email account. Once they gain access to your email, they can reset passwords for any other accounts linked to it. Therefore, your email password must be unique and never reused anywhere else.” Evidence grade C. The original states the population, caveats, and sources; this is not a personal forecast.
Use the original facts and limits. For an urgent medical, safety, financial, or legal issue, contact a qualified local professional or service.
THE ENGLISH EDITION
Original recommendation and evidence
2. Use a unique password solely for your email
Cost: No cost involved. Storing it in a password manager eliminates the need to memorize it. The real challenge lies in breaking the old habit of reusing one password across multiple sites.
In plain terms: If a password you use elsewhere gets stolen, attackers can use it to log straight into your email account. Once they gain access to your email, they can reset passwords for any other accounts linked to it. Therefore, your email password must be unique and never reused anywhere else.
Benefit: Credential stuffing is one of the easiest attack methods: attackers simply test stolen passwords against other accounts. If your email password is compromised, all accounts that rely on it for password recovery become vulnerable too. The US Cybersecurity and Infrastructure Security Agency recommends using a distinct, strong password of at least 16 characters for every account, and storing it via a password manager.
Evidence grade: C
Notes: If you struggle to memorize passwords, use the built-in password manager in your web browser. It stores passwords for each site for you, which is far safer than reusing the same password everywhere. Avoid saving passwords in WeChat favorites or note-taking apps.
Sources: US CISA. Use Strong Passwords. <https://www.cisa.gov/secure-our-world/use-strong-passwords>
Read the complete Chinese source and notes
2. 邮箱密码单独一个，不和任何网站重复
成本: 不花钱。用密码管理器存着就不用自己记。难的是要改掉一个密码到处用的老习惯。
说人话: 别的网站被偷走的密码，会被人拿来直接登你的邮箱。邮箱一旦被人登进去，凡是能用邮箱找回密码的账号，都跟着一起丢。所以邮箱的密码要单独一个，别的地方一律不用。
收益: 把别处泄露的账号和密码挨个拿来试着登，这叫撞库，是最省事的攻击方式，你的邮箱也会被这样试。邮箱一旦被人登进去，所有用它找回密码的账号一起丢。美国网络安全和基础设施安全局的建议是：每个账号用一个不同的强密码，至少 16 位，交给密码管理器存
证据等级: C
来源: US CISA. Use Strong Passwords. <https://www.cisa.gov/secure-our-world/use-strong-passwords>
备注: 记不住就用浏览器自带的密码管理器。它替你记住每个网站的密码，比到处用同一个密码强得多。别把密码存在微信收藏或者备忘录里
YOUR PRIVATE LIST