After this lesson, you will be able to: Explain why humans are bad at passwords, how password managers and passkeys work, and apply developer-specific credential hygiene.
The defensive counterpart to the attack lesson. We cover why human password habits fail, how password managers work, passkeys (FIDO2) as a phishing-resistant replacement for passwords, and credential hygiene specifically for developers handling service credentials.
People cannot remember many strong, unique passwords, so they reuse them, pick predictable patterns (a word plus a year plus a symbol), and modify one base password slightly per site. Attackers know all of this; wordlists and rules encode exactly these human tendencies. The fix is not 'try harder to remember,' it is to stop relying on human memory at all.
A password manager generates and stores a unique, long, random password for every site, locked behind one strong master password (and ideally MFA). You remember one secret; the manager handles the rest. Cloud-synced managers (Bitwarden, 1Password) sync across devices; local ones (KeePassXC) keep the vault file under your control. The master password protects everything, so it must be strong and never reused. This single habit eliminates password reuse and the credential-stuffing risk that comes with it.
Passkeys implement the FIDO2/WebAuthn standard. Instead of a shared secret, your device holds a private key and the site holds the matching public key; logging in proves you control the private key without ever sending a password. Passkeys are phishing-resistant because the credential is cryptographically bound to the real site's origin, so a fake login page cannot capture anything reusable. They also cannot be leaked in a server breach the way password hashes can. Adoption is growing fast across major platforms.
Pick one.
A weak or reused master password, which undoes the whole manager. No MFA on the password manager or email (the email resets everything else). Storing API keys in a notes app or chat instead of the vault. Sharing a single team login instead of per-user access. Thinking SMS MFA is as strong as a passkey or hardware key. Never rotating long-lived credentials.
Sign in and purchase access to unlock this lesson.