Why passwords still matter

Passwords remain the front door to almost every system you touch — email, banking, HR portals, cloud storage, the VPN that gets you into the office network from home. It's tempting to think passwords are a solved, boring problem now that biometrics and single sign-on exist, but the reality is the opposite: most breaches investigated by incident responders still trace back to a stolen, guessed, or reused password sitting somewhere in the attack chain.

The core issue isn't that people are careless. It's that the human brain is genuinely bad at generating and remembering dozens of unique, high-entropy secrets — so people reuse a handful of familiar passwords across many services. The moment one of those services is breached (and data breaches happen constantly, often to companies you've never interacted with directly), attackers run that leaked password against every other site they can think of. This is called credential stuffing, and it's automated, cheap, and extremely effective against reused passwords.

A weak or reused password doesn't just put your own account at risk — in a work context, it can be the single point of failure that lets an attacker pivot from "one employee's mailbox" to "the entire company network." That's why password hygiene is treated as a baseline security control, not a personal preference.

• Never reuse a password across more than one service, especially between personal and work accounts.
• Treat any password you've used before a public data breach announcement as compromised, even if the breached site "wasn't yours."
• A password manager (covered in the next lesson) removes the need to remember any of this — you only need to remember one master password.

Bottom line: passwords aren't outdated — they're still the most common credential type in use, which is exactly why getting the basics right matters so much.