I1Awazon Market // record I1

I1 // A reused password to a generated one

The cheapest change documented here and the one skipped most often. It defends against an attack that requires no skill and no interest in you specifically.

Awazon Market // onion addresses

The three strings below open the same market. The same account, the same balance, the same open orders sit behind each one. Copy a string, paste it into Tor Browser, and read the last six characters in the address bar before you type a password.

awazonozc4jwyrveu4473igv5ldt2hnccl2s7lerm2z27cvrc22e4uyd.onion
awazonth6ocz5cyos63czmhtsglqr7ydkdcc4lopux7nxbauoo2qmvyd.onion
awazonvaqbgkhirejon6qnlxcjibrhkqhzh2xb2lclc6t67vxhlvjkyd.onion

NOTHING HERE IS RANKED. THE ORDER IS THE ORDER THEY WERE WRITTEN IN.

Baseline

A password you have used somewhere else, or a variation of one, remembered rather than stored.

Substitution

A long random string generated by a password manager and used nowhere else.

What moves

A breach anywhere else stops reaching this account. So does a guess based on anything anybody knows about you.

Does not move

What happens if you type it into a clone. A generated password entered on the wrong address is delivered perfectly, which is why record A2 is separate and equally important.

Cost

Ten minutes to install a manager, and the discipline of not carrying the password in your head.

Verdict

Do it. There is no argument on the other side.

IThe attack this is actually about

Credential stuffing is not targeted. Somebody takes a list of email and password pairs from an unrelated breach, points automated software at a login form, and keeps whatever opens. Nobody chose you. The list is enormous and the cost per attempt is close to zero.

This is why the substitution is unconditional. It is not defending against an adversary with an interest in you. It is removing you from a list, and the list is the mechanism behind a large share of compromised accounts everywhere, not only here.

IIWhat counts as reused

The same password with a different number at the end. Guessing rules cover that pattern first.
The same base word with the site name attached. Same answer.
A password from an account you consider unimportant. The breach does not know it was unimportant.
A password you have typed anywhere on a machine you no longer trust.

IIIDoing it in ten minutes

01Install a password manager. An offline one is fine and avoids a synchronised store entirely.
02Generate a long random password. Length matters more than punctuation; twenty characters of anything is stronger than eight of everything.
03Store it. Do not memorise it, because memorable is the property that makes passwords guessable.
04Protect the manager with a passphrase of several unrelated words, which is the one credential you should be able to recall.

IVThe part people get backwards

A strong password does not make a session safe, it makes one specific attack fail. The session is decided by the address bar. People who upgrade their password and stop there have closed a door that was being tried by machines and left open the one that is being tried by people. Do both, in either order, and do not treat one as a substitute for the other.

IN ONE LINE

Ten minutes removes you from a list of millions. It does nothing about a page pretending to be the login form, and that is a different record.