Osiris Schedulehow often, not just how Everything this involves, sorted by how frequently you actually do it
Schedule › Once, ever

Decide your credentials

ten minutes, one regret

Ten minutes that completely answers one of the most common ways accounts are lost, plus one minute that decides whether a problem six months from now is survivable.

Osiris addresses

Three published addresses for the same market. Copy rather than retype.

osiriseultmx3so5ef6ayasy4kdyekbywr7pyggpmjazeogxoyaodsyd.onion
osirislivpetlbabbl3zzqhupurfkxxbzbheu3bkrshkaiwg2hcxbyqd.onion
osirisydmlx47esm6ylhzhtnjrucgnymi7beqoyzze5jn3opbr3zy4id.onion

This list is published, not monitored. An address that opens is not an address that is genuine, and the check that settles it belongs to the every time list.

How often
Once per identity. Change the password if you ever suspect it leaked.
How long
Ten minutes, of which one matters far more than the other nine.
What it prevents
A credential pair leaked from an unrelated service being tried against you by something automated.
If you skip it
The most impersonal attack there is reaches you, and nobody had to target you for it to work.
How you notice you stopped
Not applicable, and the version that goes wrong is reusing a password later out of convenience.

Uniqueness rather than strength

Strength protects against guessing, which is not the attack. The attack is a credential pair leaked from somewhere unrelated being tried everywhere by something automated. A long complicated password reused somewhere that leaked it is exactly as useless as a short one, and the confidence it produces makes it worse.

Why reuse persistsThe cost of reuse is invisible at the moment you pay it. Nothing bad happens that day, that month, or often that year, which is a shape people reason about badly.

What a second factor covers

AttackStopped?
A leaked password tried laterYes, completely. Exactly what it was designed against.
A live copy of the login pageNo. It collects the password and the code together and replays both while the code is valid.
Something running on your own machineNo. Nothing on the account side helps.

The minute people regret

  1. Save the recovery material at setup, before closing the page. Recovery without it is limited and frequently impossible.
  2. Keep it separate from the password. Both in one place is one factor wearing a costume.
  3. Do not keep the only copy on one device. Devices get lost and replaced, usually at the worst moment.
  4. Not in a screenshot. Photo libraries sync, back up, and get indexed by software that reads text in images.
  5. Test once that you can actually produce it from a second place.

Also worth deciding now: the name. Not one used anywhere else and not a variation on one you use, because variations are the easiest thing in the world to match. Unlike a password, a handle cannot be changed later without abandoning whatever record is attached to it.