Passwords and Multi-Factor Authentication
Learn how unique passwords, password managers, and MFA reduce the impact of account attacks.
Use Unique Passwords
theoryUnderstand why a password leak on one service can affect every account that reuses it.
One account should not unlock every account
Attackers regularly try leaked username-and-password pairs on other services. Reusing a password turns one unrelated breach into a chain of account takeovers.
Use a different password for every important account. A password manager can generate and remember long, random passwords so you do not have to memorize each one. Protect the manager with a strong unique master password and MFA.
Never share passwords through chat or email. Legitimate support staff should not need your password.
Knowledge Check
What can happen when the same password is reused across several services?
Add a Second Factor
theoryCompare MFA methods and understand how they add protection beyond a password.
A password is not the only proof of identity
Multi-factor authentication asks for another kind of proof after the password. Common factors include something you know, something you have, and something you are.
Prefer a security key or an authenticator app when available. Push approvals can be useful, but never approve an unexpected prompt. SMS codes are better than a password alone but can be exposed through phone-number attacks, so treat them as a fallback where stronger methods are unavailable.
Knowledge Check
An MFA approval request appears, but you did not try to sign in. What should you do?
Protect Recovery Options
theoryReview the recovery settings that can help or undermine account security.
Recovery is part of the account boundary
An attacker who controls a recovery email address or phone number may be able to reset the account even without the current password. Keep recovery details current, protect the recovery account with its own unique password and MFA, and store backup codes somewhere private and offline.
Review active sessions and connected applications after a suspected compromise. Sign out unknown sessions, remove unfamiliar access, and contact the service through its official support channel.
Knowledge Check
Which recovery setup makes it harder for someone else to take over the account?
Respond to an Account Alert
theoryPractice the safest response to an unexpected sign-in or MFA notification.
Treat unexpected prompts as a possible compromise
An unexpected sign-in alert or MFA prompt may mean that someone knows your password. Deny the prompt and do not approve repeated requests just to make them stop.
From the service’s official website or application, change the password, review recent activity, sign out other sessions, remove unfamiliar applications, and check recovery details. Report the event to the service if the activity was not yours.
Knowledge Check
You receive an unexpected MFA prompt. Which response protects the account instead of giving an attacker access?
Make an Account Plan
theoryCombine password, MFA, and recovery choices into a practical account-protection plan.
Protect the account and its recovery path
For each important account, make sure the password is unique and stored safely, a strong MFA method is enabled, and recovery details are current. Keep backup codes private and review active sessions and connected applications from time to time.
Protect the email account that receives recovery messages especially carefully. If it is compromised, an attacker may be able to reset other accounts even when those accounts use strong passwords.
Knowledge Check
Which combination gives an important account a sensible, strong baseline of protection?
Recover a Compromised Account
theoryPractice containing an account takeover while preserving evidence and protecting connected services.
Contain the compromise, then rebuild trust
You notice a sign-in from an unfamiliar location and an email saying that your recovery address was changed. You still have access to the account on one trusted device.
Use that trusted device to open the official service, change the password, sign out other sessions, restore the correct recovery details, and remove unknown applications. Revoke active sessions and API tokens when the service provides that option. Save the alert details for support, contact the service through its official recovery process, and change any other account that reused the exposed password.
Do not follow links in the alert email or send a recovery code to anyone who contacts you. If the account controls work or financial information, escalate quickly to the organisation responsible for it.
Knowledge Check
You still have one trusted device after a suspected account takeover. What is the most complete response?