Passwords & MFA

Your password is often the only thing standing between an attacker and your email, your work accounts, and your organization's data. This course covers how modern attackers actually break passwords — and the simple habits that make yours effectively uncrackable.

How Passwords Actually Get Stolen

Understanding the attack shapes the defense. Passwords are rarely "guessed" in films-style fashion; they are:

• Reused from breaches. Billions of leaked credentials circulate online. Attackers feed them into other sites automatically (credential stuffing). If your LinkedIn password from 2016 is also your bank password today, you are exposed.
• Cracked offline. If a site is breached, attackers try trillions of guesses per second against the stolen hashes. Short passwords — even P@ssw0rd! style ones — fall in hours. Symbols swapped for letters are the first pattern cracking tools try.
• Phished directly. A convincing fake login page collects your password in real time. No password strength survives typing it into the attacker's site.
• Keylogged or shoulder-surfed. Malware or a watching eye on an unprotected screen.

The lesson: strength matters (cracking), uniqueness matters (reuse), and MFA matters (phishing and keylogging — a stolen password alone is not enough to log in).

Passphrases: Length Beats Complexity

Modern guidance is simple: long and memorable beats short and cryptic.

A passphrase is a sequence of random words:

lantern-mango-plateau-9-donkey
karachi-rain-telescope-biryani-vault

Why it works:

Rules of thumb:

• Minimum 4 random words, ideally 5, joined with hyphens or spaces.
• Add a number or symbol if the site demands it — not because it helps much.
• Make the words random, not predictable phrases (four-score-and-seven, famous quotes, and song lyrics are in cracking dictionaries).
• Never include your name, family names, NIC digits, phone number, birthdays, or Pakistan123-style patterns.

Your work password should be a unique passphrase used nowhere else — especially not for personal email or social media.

One Account, One Password

Reusing a password is like using one key for your house, car, and office — lose it once and everything opens.

• Your email account is the master key of your digital life: password resets for everything flow through it. Give it the strongest, most unique passphrase plus the strongest MFA available.
• Your work account deserves the same discipline. A compromised work email becomes a launchpad for phishing your colleagues.

The honest question is: "Can a human really remember a unique 30-character passphrase for 100 accounts?" No — and that is what password managers are for.

Password Managers

A password manager stores all your credentials in one encrypted vault, unlocked by a single strong master passphrase (the one passphrase you must memorize).

What a manager gives you:

• Unique, machine-generated passwords for every account — you never invent or reuse one again.
• Autofill that refuses to fill on the wrong domain. A password saved for yourbank.com.pk will not autofill on yourbank-verify.com — a built-in phishing alarm.
• Secure notes for recovery codes, and safe sharing of team credentials.
• Breach alerts when a stored service is compromised.

Treat the master passphrase like a house key: long, unique, never written on a sticky note, never typed into any website other than the manager itself. If the manager offers MFA on the vault — enable it.

Approved manager use at work: use only the organization-approved tool, never store work credentials in personal managers or browser-synced accounts you do not control.

Multi-Factor Authentication (MFA)

MFA means logging in requires something beyond the password:

Ranked for real-world use:

1. Hardware security keys (FIDO2) — phishing-resistant; fake sites cannot capture them.
2. Authenticator apps (TOTP) — time-based 6-digit codes; not tied to your SIM.
3. Push approval in a trusted app — good, but see fatigue attacks below.
4. SMS codes — better than nothing, but vulnerable to SIM swap fraud, where the attacker transfers your mobile number to their SIM through social engineering at a franchise shop.

Enable MFA everywhere it is offered — email, banking, JazzCash/EasyPaisa, cloud accounts, and especially your work accounts. Where the choice exists, prefer an authenticator app over SMS.

Store the backup/recovery codes you get when enabling MFA in a safe offline place. Losing your phone should not mean losing your account.

MFA Fatigue (Push Bombing) Attacks

Attackers who already have your password (from a breach or phish) face one obstacle: your MFA. Their trick is simple and human:

1. They log in at 2 AM and trigger a push notification: "Approve sign-in?"
2. You deny it. They trigger another. And another. And another.
3. Half-asleep, annoyed, you tap Approve just to make it stop.

Sometimes they follow up with a message: "IT here — we're testing, please approve the prompt."

Your defenses:

• Never approve a prompt you did not personally trigger. Not once, not "just to stop them".
• Repeated denials are an alarm, not an annoyance: your password is compromised. Change it immediately and report.
• If your MFA app offers number matching (you must type a number shown on the login screen), enable it — it defeats blind approval.
• Prefer authenticator-app codes over push where possible.

Protect the Recovery Path

Attackers take the road you forgot to guard:

• Security questions ("mother's maiden name") are researchable from social media. Treat answers as extra passwords — random strings stored in your manager.
• Recovery email/phone — keep them current and secured with MFA.
• Old accounts you no longer use still hold data and trust — close them or at least secure them.

Credential Rules at Work

Personal discipline scales up to workplace rules that protect the whole organization:

• One person, one account. Shared logins destroy accountability — when six people use admin or reception@, no log can say who did what, and one phish compromises everyone at once.
• Service accounts and systems passwords belong in the approved vault, not in code repositories, configuration files, chat history, ticket comments, or spreadsheets. A credential committed to Git lives forever.
• Never authenticate into a system someone else hands you. "Just use my login, it's faster" is how audits fail and incidents spread.
• Lock your screen every time you step away (Win+L / Ctrl+Cmd+Q) — an unlocked session bypasses even the best password.
• Report suspected credential exposure immediately — a password that "might" have been seen is a password that must be rotated. Minutes matter, and no one will blame you for a false alarm.

Your work credentials unlock more than your email: shared drives, customer data, internal tools, and the trust colleagues place in messages "from you". Treat them like the keys to the building, because that is what they are.

Key Takeaways

• Length wins: use 4–5 random-word passphrases, minimum 12–16 characters anywhere a passphrase will not fit.
• One account, one password — email and work accounts get unique, top-strength credentials.
• A password manager makes uniqueness automatic and autofill catches fake domains.
• Enable MFA everywhere; prefer authenticator apps or hardware keys over SMS.
• Unexpected MFA prompts mean your password is in enemy hands — deny, change, report.