Hypotheses uses every means available to provide the platform and its bloggers a maximum security. As a user of the platform, you have a role to play in this security, notably by choosing a secure password for your account.
Use the WordPress password generator
If you wish to change your Hypotheses account password, for whatever reason, know that WordPress has an integrated secure password generator.
You can change your password by going to the dashboard of your blog > “Users” > “Your profile”, and click the “Generate password” option. It will change the password associated to the user account you are logged in with, independently of the blog you are currently on. As in, if you use one user account for several Hypotheses blogs, the new password will be the one to use to access all those blogs.
To accept that password, click on the “Update profile” button. To cancel, quit the page without clicking that button.
Manually choosing a new Hypotheses account password
To manually choose a new Hypotheses account password, replace the text in the “new password” field that is generated when you click on “Generate new password”. If WordPress judges that the password you chose has a very weak or weak security level, you will need to tick “Confirm use of weak password” before you can validate your new password by clicking the “Update Profile” button.
It is not easy to evaluate the “strength” of a password, and the automatic gauges that associate a colour or a security level to a password do not have a guaranteed reliability.
To choose a password which positions honourably on a password security scale (from 0 = “password identical to login” to ∞ = “password impossible to hack”), here are some good practices:
Password security good practices
- Use a different password for each online service you use (even more between services belonging to your “personal” life and those belonging to your “professional” one);
- Choose a password that doesn’t have yourself, your employer, your family as an inspiration;
- Do not ask anyone to create your password for you (even less to send it to you as clear text). If it cannot be avoided, change it as soon as you receive it, and do the same with passwords generated “by default” and sent to you as clear text;
- Choose an at leat 12 signs-long password with varied characters (capitals, lowercases, numbers, special characters) without any repeating sequence;
- Do not store your logins and passwords in an exposed place (avoid post-its on screen, papers in binders, text online, “reminder” e-mail);
- Change your password as soon as you have a doubt about whether it could be compromised;
- Configure your internet browser so that it doesn’t “remember” your passwords.
Use a password manager
If you are hesitating to create a lot of different and complicated passwords because you fear you will not be able to remember them, know that password managers exists, such as the open-source Keepass. This password manager, like others, can be used on various platforms (Mac, Windows, Linus, iOS, Android, …) and can synchronise via the internet to be up to date across all platforms.
This kind of tool allows you to log in with one single master password to open a database that remembers all of your other passwords for you. That single password can be used in association with a key file (like an additional sentence that needs to be present to log in to the database), constituting a composite master key for even more security.
To be noted
If the Hypotheses policy is to not intervene directly on your blogs unless you specifically ask us to do it for a reason or another, we reserve the right to change your password if we notice that the one you are currently using is compromising your blog’s security, and thus, the platform’s. This applies in the case you are using a password identical to your login, which represents a major security risk. Of course, the case being, you will be informed of this change so you can keep using your blog without problem.