![\"CISA](\"https:\/\/www.newsbeep.com\/il\/wp-content\/uploads\/2025\/12\/1764938950_168_0x0.jpg\")
<\/p>\n<\/p>\n
Make these password changes now.<\/p>\n
SOPA Images\/LightRocket via Getty Images<\/p>\n
Passwords are dangerous \u2014 they\u2019re stolen, leaked and breached. Warnings are issued weekly, confusing users who have an average of 168 passwords<\/a> each. And so it\u2019s no surprise the government has now stepped in, telling users to make changes now.<\/p>\n Passwords have never been more at risk. That\u2019s why Google warns hackers are gaining access to accounts<\/a> and Microsoft tells users to delete passwords<\/a> altogether. With multi-factor authentication (MFA) also under attack<\/a>, account security needs to change. <\/p>\n But where do you start?<\/p>\n ForbesMicrosoft Teams Starts Telling Your Boss Where You Are\u2014Now Just 8 Weeks AwayBy Zak Doffman<\/a><\/p>\n Fortunately, America\u2019s cyber defense agency has just given you the answer. As well as warning iPhone and Android users only to use encrypted messaging platforms, not to use VPNs and to change app permissions, CISA<\/a> also has password advice<\/a>.<\/p>\n Users should \u201cenroll each account in FIDO-based authentication,\u201d the federal agency says. That means changing to \u201cpasswordless.\u201d As for where to start, CISA says make changes \u201cespecially (to your) Microsoft, Apple, and Google accounts.\u201d<\/p>\n That\u2019s because these are gateway accounts. Not only does their single sign-on (SSO) open multiple in-house platforms, they can also be used to sign into third-party accounts. And because these are the dominant email and operating system platforms, the treasure trove of sensitive personal data they unlock is invaluable.<\/p>\n For almost all users, going passwordless means changing passwords for passkeys. This combines your password and MFA into a single token that is stored on your personal device and secured by your authenticated access to that device.<\/p>\n Just adding passkeys is not enough, though. You must also \u201cdisable other, less secure forms of MFA,\u201d CISA says. And at the same time, you should review all your passwords if they can\u2019t be deleted, and so remain a form of account access. That\u2019s where the value in a third-party password manager comes in.<\/p>\n