Skip to main content

Documentation Index

Fetch the complete documentation index at: https://roadtocybersec.com/llms.txt

Use this file to discover all available pages before exploring further.

​
Password Security & Multi-Factor Authentication

Passwords are the most common authentication mechanism in the digital world, and they are also the weakest link. According to Verizon’s 2023 DBIR, stolen or compromised credentials were the initial attack vector in 49% of all breaches. The problem is not that passwords are inherently insecure. The problem is that humans are terrible at creating, remembering, and managing them securely.

​
Why Most Passwords Fail

​
The Predictability Problem

When asked to create a “strong” password, most people follow the same patterns:
  • Start with a common word: Password, Summer, Welcome
  • Capitalize the first letter: Password
  • Add numbers at the end: Password123
  • Add a special character to satisfy requirements: Password123!
Attackers know this. Modern password-cracking tools like Hashcat and John the Ripper use dictionaries, rule-based mutations, and pattern masks that specifically target these human tendencies. A password like Summer2024! can be cracked in seconds.

​
Password Entropy

Entropy measures the unpredictability of a password in bits. Higher entropy = harder to guess.
Password TypeExampleApproximate EntropyTime to Brute Force (at 10B guesses/sec)
6-char lowercasekdjfmz~28 bits< 1 second
8-char mixed case + numbersP@ssw0rd~47 bitsMinutes (dictionary attack)
12-char random mixedkX9#mQ2$bL4!~79 bits~19,000 years
4-word passphrasehorse-battery-staple-correct~55 bits (common words)Days to weeks
5-word passphrase (Diceware)clash-atlas-grief-hound-cedar~64 bits~58 years
20-char random (password manager)aK8$mQ2x!bL4nR7@wZ9~131 bitsHeat death of the universe
The key insight: length beats complexity. A 20-character random password is astronomically harder to crack than an 8-character “complex” one. This is why password managers are essential; they generate and remember passwords that humans never could.

​
Passphrases

A passphrase is a sequence of random, unrelated words used as a password. They are an excellent compromise between security and memorability:
  • ✅ clash-atlas-grief-hound-cedar (strong - random words, no pattern)
  • ❌ i-love-my-dog-max (weak - predictable, personal information)
  • ❌ to-be-or-not-to-be (weak - famous quote, in every dictionary)
The Diceware method is the gold standard for generating passphrases: you physically roll dice to select words from a predefined list, guaranteeing true randomness.

​
Password Managers

A password manager is a secure, encrypted vault that generates, stores, and autofills your credentials. It solves the fundamental problem: you only need to remember one strong Master Password, and the manager handles the other 200+ accounts.

​
How They Work

  1. Your vault is encrypted locally using your Master Password + a key derivation function (PBKDF2, Argon2, or scrypt).
  2. Only you know the Master Password, the password manager company cannot decrypt your vault.
  3. For each account, the manager generates a unique, random password (20+ characters).
  4. Browser extensions and mobile apps autofill credentials, eliminating the need to type passwords.
ManagerTypeBest For
BitwardenOpen-source, cloud-syncedGeneral use, transparency-conscious users
1PasswordCommercial, cloud-syncedFamilies and teams, excellent UX
KeePassXCOpen-source, local-onlyMaximum control, offline environments
Apple KeychainBuilt into iOS/macOSApple ecosystem users
Your Master Password is the single point of failure. It must be strong (5+ word passphrase), unique (never used anywhere else), and never written down in plain text. If you forget it, most password managers cannot recover your vault.

​
Multi-Factor Authentication (MFA)

MFA adds additional layers of verification beyond just a password. The principle is based on three authentication factors:
  1. Something you know: Password, PIN, security question
  2. Something you have: Phone, hardware key, smart card
  3. Something you are: Fingerprint, face scan, iris scan
True MFA requires at least two different factors. Two passwords are not MFA; they are both “something you know.”

​
The MFA Spectrum (Weakest to Strongest)

1

SMS Codes (Weakest)

A one-time code sent via text message. Better than no MFA, but vulnerable to SIM swapping, where an attacker convinces your carrier to transfer your phone number to their SIM card. In 2019, Twitter CEO Jack Dorsey’s account was hijacked via SIM swap.
2

Email Codes

A one-time code sent to your email. Slightly better than SMS, but if the attacker already has access to your email, this is useless.
3

Authenticator Apps (Good)

Apps like Google Authenticator, Authy, or Microsoft Authenticator generate time-based one-time passwords (TOTP) that rotate every 30 seconds. These are not vulnerable to SIM swapping because the codes are generated locally on your device.
4

Push Notifications (Good)

Apps like Duo or Microsoft Authenticator send push notifications that you approve or deny. However, these are vulnerable to MFA fatigue attacks, where an attacker repeatedly sends push requests until the victim approves one out of frustration.
5

Hardware Security Keys (Excellent)

Physical devices like YubiKey or Google Titan that use the FIDO2/WebAuthn protocol. You plug the key into your USB port or tap it to your phone. These are phishing-resistant because the key cryptographically verifies the domain, if the site is a phishing clone, the key simply will not authenticate.
6

Passkeys (Best)

Passkeys are the future of authentication. They use FIDO2/WebAuthn to replace passwords entirely. Your device (phone, laptop) stores a private key, and authentication happens via biometrics (fingerprint, face scan) or device PIN. No password to steal, no code to intercept, no key to lose.

​
What to Enable MFA On (Priority Order)

  1. Email: Your email is the master key to every other account (password resets go here).
  2. Password manager: If this is compromised, every password is exposed.
  3. Banking and financial services: Direct financial impact.
  4. Cloud storage (Google Drive, Dropbox, iCloud), May contain sensitive documents.
  5. Social media: Attackers use compromised social accounts for phishing and impersonation.
  6. Everything else: Enable MFA on every service that supports it.
If you do nothing else after reading this page, do these two things: (1) Install a password manager and generate unique passwords for your top 10 accounts. (2) Enable authenticator-app-based MFA on your email and banking accounts. These two actions alone will make you harder to compromise than 95% of internet users.

​
Key Takeaways

  • Length beats complexity: A 20-character random password is stronger than an 8-character “complex” one.
  • Never reuse passwords: One breach should not cascade to every account you own.
  • Use a password manager: It is the only way to maintain unique, strong passwords at scale.
  • Enable MFA everywhere: Start with email and banking. Use authenticator apps or hardware keys over SMS.
  • Passkeys are the future: As more services adopt them, passwords will gradually become obsolete.