Passwords, MFA and phishing

Three attacks account for a huge share of real-world breaches: stolen or guessed passwords, bypassed or absent MFA, and someone being tricked into approving access. The defences are well known. The gap is usually habit, not knowledge.

How passwords fail

Passwords fail in predictable ways:

• Reuse: one breach exposes the same password on a dozen sites.
• Guessing: short or predictable passwords fall to dictionaries and rules.
• Phishing: the password is typed into the wrong site.
• Stuffing: breached username/password pairs are replayed automatically.
• Offline cracking: a stolen hash database is attacked at high speed.

Length helps because each additional character multiplies the search space. Uniqueness helps because it stops one breach from spreading. Memorability is the constraint that makes both hard, which is exactly what a password manager solves.

A password strategy that works

1. Use a password manager to generate and store a unique password per site.
2. Protect the manager with a long passphrase and strong MFA.
3. Make the master passphrase memorable and never reuse it.
4. Check important accounts against a breach service such as Have I Been Pwned.
5. Change a password when it is exposed, not on a fixed calendar.

A long passphrase of several random words is easier to remember and harder to crack than a short string of substitutions. Tr0ub4dor&3 is not stronger than four random words; it is just harder to type.