- How often
- Never, without exception.
- Cost of following it
- Ten minutes at setup, once.
- What it prevents
- The most automated attack in this subject, completely.
- Why people break it
- The cost is invisible at the moment you pay it. Nothing bad happens that day, that month, or often that year.
- If you already did
- Change it here and everywhere else you used it, because the same list is being tried everywhere.
Uniqueness rather than strength
Strength protects against guessing, and guessing is not the attack. A long complicated password reused somewhere that leaked it is exactly as useless as a short simple one, and the confidence it produces makes the situation worse rather than better.
What a second factor adds
| Attack | Stopped? |
|---|---|
| A leaked password tried later | Yes, completely. Exactly what it was designed against. |
| A live copy of the login page | No. It collects password and code together and replays both while the code is valid. |
| Something running on your own machine | No. Nothing on the account side helps. |
So a second factor is worth turning on immediately and it is the second line. The first is arriving at the genuine site, which is the per session check.
The related rule about names
The same logic applies to the handle, with one difference that makes it worse. A password can be changed. A handle cannot, not without abandoning whatever record is attached to it, and anything posted under that name years ago becomes attached to this the moment a connection exists. Variations do not help, because variations are the easiest thing in the world to match.