Lab 3 · Strong Password + Two-Factor Authentication Setup Lab

🎯 Objective

Raise your real account security to professional baseline in one session and document what you changed.

🧩 Skills You Will Practice

• Passphrase design
• Password managers
• Authenticator-app 2FA
• Backup codes and recovery

🧰 What You Need

• Your own phone
• Your own email, social and banking accounts
• A reputable password manager (free tier is fine)
• Paper or a secure note for backup codes

📋 Step-by-Step Tasks

1. List your 5 most important accounts: primary email first, then banking, social, university and cloud storage. Email is first because it resets everything else.
2. Check each password: is it unique to that account, at least 14 characters, and not based on your name, birth date or a reused pattern? Mark each Pass / Fix.
3. For every Fix, generate a passphrase of 4+ unrelated words plus a number, and store it in the password manager — never in a chat, photo or plain notes app.
4. Turn on 2FA in each account security settings. Choose authenticator app over SMS where offered, scan the QR code, and confirm with one generated code.
5. Download or write the backup/recovery codes for each account and store them offline in a private place. Note where they are stored — not the codes themselves — in your lab notes.
6. Sign out and sign back in to one account to prove password + 2FA both work before you need them in an emergency.
7. Write a one-page audit sheet: account, unique password yes/no, 2FA method, backup codes stored yes/no, date completed.

✅ Expected Result / Deliverable

An audit sheet showing 5 accounts with unique passphrases, 2FA enabled and backup codes stored — plus one successful test login using both factors.

⚠️ Common Mistakes

• Enabling 2FA but losing backup codes
• Reusing one strong password everywhere
• Taking screenshots of codes and leaving them in the gallery