Passwords
Passwords and two-step sign-in
Most break-ins are not clever. Someone reuses a password that leaked from another site, or hands the office login to a new volunteer and never changes it. Four habits cover most of the risk.
The four habits
- A different password for every account. When one site is breached, attackers try the same email and password everywhere else. A leaked Facebook password shouldn't open your church email.
- Let a password manager remember them. It makes long, random passwords and fills them in. You remember one strong passphrase. Long beats clever: three or four unrelated words is better than Fellowship1!.
- Turn on two-step sign-in (also called two-factor, 2FA or MFA) so a stolen password isn't enough. An app or a security key is stronger than a text message, but a text message is much better than nothing.
- One person, one login. No shared "office" account. Shared passwords can't be taken back from one person without disrupting everyone, and nobody can tell who did what.
Turn on two-step sign-in here first
In this order, because each one can reset the others:
- Church email accounts (especially the pastor's and whoever handles money). Email can reset every other password. Google Workspace, Microsoft 365.
- Bank and online giving accounts.
- Church management software (see that page).
- The domain registrar and website host. Whoever controls these can take the website and the email address.
- Social media accounts, especially Facebook pages. A hijacked church page is used to scam members.
Shared logins, honestly
Some accounts really are shared: the Facebook page, the YouTube channel, a streaming service. For those, use a password manager's shared vault, so people can use the login without seeing or knowing the password, and you can remove someone's access in a click. Where a service supports separate user accounts (most do), use them.
Do this year
- Write down where recovery codes and the master passphrase are kept, and who else knows. If the one volunteer who does everything is hit by a bus, someone needs to be able to get in.
- Check whether the pastor's and staff emails appear in known breaches at Have I Been Pwned. If they do, change those passwords and make sure each is unique.
- Review who has access to each important account twice a year, and remove anyone who has moved on (see people's data).