Passwords, Passkeys, and MFA
Most account takeovers are not hacking in any cinematic sense. Nobody breaks the encryption. An attacker simply logs in with your real password — one they bought from a breach dump, guessed from your dog's name and birth year, or phished out of you on a Tuesday afternoon. Fixing this is unglamorous and takes about an evening.
The three failure modes
Reuse. When one site is breached, criminals replay that email-and-password pair against hundreds of other services within hours. This is called credential stuffing, and it is fully automated. One reused password turns one breach into ten.
Guessability. Humans making up passwords produce astonishingly similar results. Pattern-aware cracking tools try Summer2026! long before they try random noise, because millions of people genuinely believe they invented it.
Phishability. Even a strong, unique password is surrendered in two seconds on a convincing fake login page. Strength does not help when you hand it over voluntarily.
The fix, in order of impact
1. Use a password manager
You cannot remember 150 unique strong passwords, and you should not try. A password manager remembers them for you and — underrated benefit — refuses to autofill on a lookalike domain, which quietly defeats most phishing. Any reputable manager beats none; the built-in ones in iOS, Android, and modern browsers are perfectly good starting points.
2. Turn on multi-factor authentication
MFA means a stolen password alone is no longer enough. But the flavors are not equal:
- App-based codes or push prompts — good. Stops credential stuffing cold.
- SMS codes — better than nothing, but vulnerable to SIM-swapping. Fine for low-value accounts, not for your email or bank.
- Hardware keys and passkeys — excellent. Phishing-resistant by design, because the credential is cryptographically bound to the real website. A fake site cannot ask for what it cannot receive.
3. Adopt passkeys where offered
A passkey replaces the password entirely with a key pair: the private half never leaves your device, and the site stores only the public half — worthless in a breach. There is nothing to reuse, nothing to guess, and nothing to phish. Major platforms have supported them for years now; when a service offers to create one, say yes.
Protect the keystone account first
Your primary email account resets every other password you own. It is the keystone: whoever controls it controls your digital life. Give it the strongest treatment you have — unique password, phishing-resistant MFA, and recovery details that are current and actually yours.
The evening checklist
- Install a password manager and move your top ten accounts into it with fresh, generated passwords.
- Enable MFA on email, banking, and cloud storage — app-based or passkey, not SMS.
- Create passkeys on the big platforms you use daily.
- Check your email address on a breach-notification service and rotate anything exposed.
- Delete accounts you no longer use. An account that doesn't exist cannot be stolen.
Stop before you reuse. Think about what that account unlocks. Connect with credentials a criminal cannot replay.