Password security and account protection

§Text Passage

1Summary 重點摘要

A strong password is long, mixes cases, digits and symbols, and uses nothing personal. Add two-factor authentication and beware of phishing sites.

2Vocabulary cards Vocabulary

3Step by step Steps

1. How weak is weak123456, a birthday, your own name — these are the most common weak passwords. Cracking programs try millions of combinations every second, and these usual suspects sit at the top of the guessing list, broken within seconds. Reusing one password everywhere is worse: when one website's database leaks, the leaked password drags every account sharing it down together. News of hijacked game accounts usually traces back to a simple password, or the same password reused across platforms.
2. Three rules for strong passwordsStrong passwords follow three rules. First, long: at least 12 characters, because every extra character multiplies the cracking time. Second, mixed: upper and lower case letters, digits and symbols together. Third, nothing personal or common, such as a phone number or a pet's name. A practical trick is the passphrase: pick a few unrelated words and add digits and symbols, such as 藍鯨吃菠蘿42號! — long, memorable and hard to guess. In an answer, the three rules plus one example make a complete response.
3. One account, one passwordThe most important habit is one password per account, especially for email and school accounts. Email matters most, because password-reset letters for other accounts all arrive there — losing email means losing everything. Afraid of forgetting? Let a password manager keep them, encrypted behind one master password; or write them on paper kept somewhere safe at home. Either way is far safer than reusing one password everywhere, because one leaked website no longer drags the other accounts down.
4. Two-factor authenticationTwo-factor authentication (2FA) adds a layer beyond the password: the first factor is something you know — the password; the second is something you have, such as an SMS code, a number from an authenticator app, or a fingerprint. Even a stolen password cannot get in without the second factor, and the account stays safe. Turn 2FA on for email first, because email can reset the passwords of every other account; game and social accounts deserve it too. It usually lives in the security section of account settings and takes only a few minutes.
5. Spotting phishingThe classic phishing message reads 'Your account will be blocked! Log in now!' — panic designed to make you act. Pause first: check the sender's address for strange spellings, such as one wrong letter in the official domain; never log in through a link inside the message — open the official app yourself or type the official address into the browser. One rule to remember: real organisations never ask for your password or your full card number. Hong Kong scam SMS often impersonate banks and couriers; verify before tapping any link — that is the safe habit.
6. The risk of public Wi-FiFree Wi-Fi in cafes, malls and airports may be unencrypted, and a bad actor on the same network can intercept the data you send and receive, including usernames and passwords. The rule is simple: never log into banking, school or other important accounts on public networks — mobile data is safer; if you must connect, stick to activities involving no accounts, such as reading news. Also beware fake hotspots with suspicious names, like a 'free network' imitating the cafe's name — once connected, your data passes through a stranger's computer. If anything felt suspicious, change the passwords as soon as you are home.

4Diagrams Diagrams

5Worked example Example

6Common mistakes Mistakes

7Quick check Quick check

8Recap Recap

• Strong = long (12+), mixed, nothing personal
• Passphrases are memorable and strong; one account, one password
• 2FA adds a second lock; turn it on for email
• Phishing = fake sites stealing passwords; type official addresses yourself
• Never log into important accounts on other people's Wi-Fi