Passwords, Passkeys, MFA, and Recovery
Understand what each sign-in layer protects and how account recovery can quietly become the weakest link.
In this lesson, you will learn to:
- Choose unique passwords and suitable MFA.
- Protect recovery methods and respond to unexpected sign-in prompts.
Passwords, Passkeys, MFA, and Recovery
A practical account-defense lesson covering password managers, phishing-resistant passkeys, MFA fatigue, sessions, and recovery channels.
One strong secret per account
Password reuse turns one breach into many account takeovers. Attackers test leaked email-and-password combinations automatically, a technique commonly called credential stuffing. Small variations such as adding the service name or changing one digit are predictable. A password manager solves the memory problem by generating and storing a different long password for each account.
Protect the password manager itself with a strong master passphrase and its strongest available MFA. Save its recovery information safely. Never share a password or one-time code with someone who contacted you. If a service reports a breach, change that service’s password through its real app or site and change any other account where the password or a close variation was reused. Passwords contain damage only when they are unique.
Not all second factors resist phishing equally
MFA makes a stolen password less useful, but methods differ. Codes sent by text or generated in an app can still be typed into a fake page and relayed immediately. Push notifications can be abused through repeated prompts. FIDO/WebAuthn security keys and passkeys are designed to bind authentication to the legitimate site, making them phishing-resistant when correctly implemented.
Use the strongest method a service offers, especially for email, banking, password managers, cloud storage, and primary work or study accounts. Never approve a sign-in you did not start. Repeated prompts are not a nuisance to silence; deny them and inspect the account using a known route. Number matching improves push approval because you must compare the number shown by the real sign-in flow.
Recovery is another login door
An account may be recoverable through an email address, phone number, backup code, trusted device, or identity check. An attacker who controls that route may bypass the password and MFA you carefully configured. Review recovery details, remove unknown devices and stale addresses, and store backup codes somewhere protected but available when your primary device is lost.
After suspected account takeover, use a clean device if possible. Change the password, sign out other sessions, review MFA and recovery methods, inspect forwarding rules and connected applications, and check recent activity. Email deserves priority because it can reset many other accounts. Tell contacts if the compromised account sent deceptive messages, since the attacker may be borrowing your trust.
Resources
- NIST SP 800-63B-4 — Consult the final 2025 authenticator guidance for password managers, phishing resistance, and verifier-bound authentication.