C1.2Not started

Password hygiene + MFA

Reading depth

What you'll learn

  • Password manager + unique random passwords for every account.
  • MFA via app or hardware key; SMS only as last resort.
  • Never read an MFA code aloud or paste it into an unfamiliar form.

Use a password manager for every account, generate unique high-entropy passwords (16+ chars, random), and never reuse them. The dominant breach vector for individuals is credential stuffing — attackers replay a password leaked in one breach against every other account that might share it.

MFA: prefer authenticator app or hardware key over SMS. SMS MFA is better than no MFA but is vulnerable to SIM-swap. Hardware keys (FIDO2/WebAuthn) are the gold standard because they bind the credential to the origin and resist phishing.

Never share an MFA code. If someone — even "IT" — calls and asks you to read your code aloud, the call is the attack. Legitimate support will never ask for the code; legitimate password resets never require it from another person.

Key points

  • Password manager + unique random passwords for every account.
  • MFA via app or hardware key; SMS only as last resort.
  • Never read an MFA code aloud or paste it into an unfamiliar form.

Pitfalls

  • Reusing 'just one' password — the one most likely to be in a breach dump.
  • Approving an MFA prompt you didn't initiate ('MFA fatigue' attack).

Ask your security team

In a real Adept rollout this routes to your company's security Claude project; in the demo it opens a fresh Claude chat.